According to ME News, on November 6 (UTC+8), FOUNDATION, the developer of the Bitcoin hardware wallet Passport, released a post-incident review report detailing a security breach. The attacker exploited a code execution vulnerability in FOUNDATION’s self-hosted Cal.com scheduling system to compromise the server, then leveraged another vulnerability in the Bank-Vaults component connecting to HashiCorp Vault to steal multiple service credentials. This allowed the attacker to access customer records, send phishing emails via their email service provider, and modify domain settings. The earliest unauthorized activity was traced back to October 21. A total of over 23,000 phishing emails were attempted, targeting 21,463 email addresses. FOUNDATION stated that funds stored on Passport devices remain secure, with no recall or device replacement plan in place, and no request for users to provide their recovery phrases.
The leaked information includes names, email addresses, mailing addresses, phone numbers, order details, historical customer service records, and partial credit card information such as the cardholder name, last four digits of the card number, and expiration date—the full card number was not compromised. Some users have reported receiving fraudulent calls from individuals impersonating FOUNDATION customer service, who accurately provided order details and the last four digits of their card numbers, and attempted to trick them into revealing their recovery phrases or transferring funds under the pretense of product recalls or device replacements. FOUNDATION stated that it will migrate as many self-hosted services as possible to managed infrastructure and tighten access permissions across all applications.
Foresight News previously reported that on October 27, FOUNDATION stated its email system recorded over 23,000 attempted phishing email sends, and some historical order personal information may have been compromised; however, there is currently no evidence that Passport hardware devices or the private keys stored on them have been affected. (Source: Foresight News)
FOUNDATION Reports Security Breach via Vulnerability in Cal.com Booking System
KuCoinFlashShare
Summary
On October 27, 2026, FOUNDATION disclosed a security breach following a report on a vulnerability. Attackers exploited a code execution flaw in the Cal.com booking system and leveraged a Bank-Vaults vulnerability to steal service credentials. This unauthorized access resulted in phishing emails being sent to over 21,463 addresses and unauthorized domain changes. The activity began as early as October 21. Passport funds remain secure, with no recall planned. Exposed data includes names, email addresses, physical addresses, phone numbers, order history, and partial credit card details. Fraudulent calls impersonating customer support have been reported. The company will migrate self-custody services to managed infrastructure and implement stricter access controls.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.