Foundation flags 5,600 addresses at risk after phishing campaign against Passport users
Source report: 2026-10-26 · Editorial analysis published: 2026-10-27
The wallet maker’s October 26 update identifies potentially exposed customer records. More than 23,000 email attempts are a separate count; Foundation reports no evidence of compromised devices or private keys.
A newer update puts numbers on the risk
Foundation has identified records containing approximately 5,600 mailing addresses and 5,200 phone numbers, together with names and email addresses, in systems attackers could reach. The Passport hardware-wallet maker published those figures in its second incident update on October 26 at 18:53 UTC. It cannot confirm that every record was accessed and is treating them all as potentially exposed.
For someone storing mining payouts on a Passport, the immediate danger is a convincing message asking for wallet recovery words. A recovery phrase is the secret backup that can recreate access to the coins. A sender knowing a buyer’s name, phone number or delivery address does not prove a request is legitimate.
Sending attempts are not a count of victims
An earlier update reported more than 23,000 phishing email attempts across the company’s email systems. It identified 19,057 messages delivered through Mailgun and 1,503 sent through Google Workspace. Some addresses received multiple messages; some attempts failed or were stopped. Those categories should not be added up and relabeled as unique customers who lost information or money.
The later update also says more than 5,000 email addresses receiving phishing messages were absent from its WooCommerce and Shopify customer records. Some matched support and hiring inboxes. Foundation now says it is confident outside data was also used, while it continues tracing its origin. This does not identify another breached company or establish a connection with a particular earlier wallet-vendor incident.
The counts also cannot be combined into 10,800 different people: one customer may have both an address and a phone number in the records. Likewise, 19,057 plus 1,503 equals 20,560, not a complete breakdown of the more than 23,000 attempts. The remaining gap does not establish another delivery channel or a hidden victim count. These figures describe what the company could establish at successive stages of an unfinished investigation. They are not a verified total of stolen coins, and no such loss total is provided in this update. A report should keep the observation time and each category attached, rather than turn a later clarification into a claim that the earlier device-security assessment was reversed.
Why old shopping records remained reachable
Foundation moved its store from WooCommerce to Shopify in May. In the older system, an automatic process was meant to redact customer information 60 days after shipping. Orders looked redacted in the administration screen, but past migrations had left copies in old database tables. The redaction updated the newer tables that the screen displayed.
Its follow-up found that the process also missed some order types and information held in abandoned carts and contact forms. Recent Shopify orders had not yet been manually redacted, and an automatic deletion tool was not active. The lesson for a customer is concrete: an old order or an unfinished purchase does not necessarily mean a retailer no longer holds an address. Foundation accepts responsibility for protecting those records.
Email access and wallet keys are different
Foundation says affected email credentials have been revoked, queued phishing messages cleared and affected legacy services taken offline. Its latest update adds rotation of all keys and secrets across its systems, including those with no evidence of access. One offline copy of the legacy store data is being retained as investigation evidence, with permanent deletion planned after the investigation.
The company reports no evidence that Passport devices or the private keys they hold were compromised. That statement concerns the device and key boundary; it does not make the emails harmless. A person can voluntarily reveal recovery words to a fake website even when the hardware has never been opened or altered. The investigation is continuing and a full report is still promised.
What a miner receiving the message should check
Use a separately opened official support channel to check an incident notice. Do not treat a familiar logo, an apparent official sender or a correct shipping address as permission to enter recovery words. Foundation says it will never request the seed words, recovery phrase, PIN or passphrase. A website claiming the wallet needs verification is not where a secret backup belongs.
A mining pool’s payout address is public receiving information; a recovery phrase controls spending. A support exchange about a delayed payout does not require that phrase. If it has already been disclosed, regard the wallet as compromised and seek verified guidance for moving remaining funds to a fresh wallet with new recovery material. Preserve the suspicious message for reporting without forwarding secrets. The useful new fact is the clarified customer-data exposure, not proof of a failure in Passport’s signing hardware.
Source: Foundation ↗
Mining calculator ↗
