Foundation Reports Cyberattack Affecting 21,463 Email Addresses

ChainCatcher report: Hardware wallet manufacturer Foundation stated that attackers exploited a vulnerability in its self-hosted Cal.com scheduling software, then leveraged another vulnerability in Bank-Vaults to steal credentials and gain access to customer records, email systems, and domain settings. The breach began on October 21; on October 25, the attackers attempted to send over 23,000 phishing emails from Foundation’s legitimate email address, targeting 21,463 email addresses. Compromised data included names, home addresses, phone numbers, order histories, customer service communications, and partial payment card information. Subsequently, scammers used the stolen purchase and payment details to contact customers directly, tricking them into revealing their Bitcoin wallet recovery phrases. Foundation confirmed that employee accounts and devices were not compromised, funds stored in Passport devices remain secure, and the company plans to reduce its self-hosted infrastructure in favor of managed services.