FOUNDATION PROMISED TO FORGET ITS BUYERS — PHISHING EMAILS FROM ITS OWN DOMAINS CARRIED THEIR HOME ADDRESSES — THE PURGE PROMISE WAS DROPPED IN MAY

In March 2022, the hardware wallet maker Foundation told its customers on X: "we automatically purge customer data from our servers 60 days after your order ships." The same post said: "Data tied to any #bitcoin company is sensitive." Late on October 25, 2026, Eastern time, emails went out from Foundation's own domains telling Passport owners about an urgent recall and pointing them to a fake app page built to take their seed words, per Bitcoin.com News. Some of those emails carried the buyer's home address and phone number.

The company's first post blamed "one or more compromised API keys on Cloudflare." Its chief executive, Zach Herbert, went further two hours later: "some of our backend infrastructure was compromised via a vulnerability in a self hosted app," and attackers "were likely able to compromise our customer support inbox." He said the addresses likely came from that inbox, from "other recent crypto leaks," and "possibly" from recent orders on the company's new Shopify store. In 2022, Foundation had sold self-hosting as the safe choice.

One buyer whose order shipped about 75 days earlier got the email. Another, whose last order was more than two years old, said it carried the full home address. On October 26, Foundation answered that the 60-day purge "isn't part of our current privacy policy," which changed in May when the store moved to Shopify. The new policy, effective May 21, 2026, keeps personal data "for as long as reasonably necessary." To one older buyer the company wrote that the order "should have been removed under the old policy," and that it is looking into "why some older records may not have been removed." It has given no count of customers hit. A formal report is promised.

The device guards the keys. The order record guards nothing. Every hardware wallet shipped to a home puts a name on a list of people who hold bitcoin, and a promise to forget is only as good as the last database migration. Keystone disclosed its own leak of buyer addresses on October 24. Foundation says Passport funds and hardware are safe. The people on the list still have to live at those addresses. At the time of this writing, bitcoin was $80,314.