Foundation, developer of the Passport hardware wallet, identified over 23,000 phishing email attempts within its systems following a security incident investigation. Of these, 19,057 emails were sent via Mailgun and 1,503 through Google Workspace, though some attempts failed or were blocked before delivery. The company emphasized that these figures do not represent the total number of individuals whose personal information was leaked, as confirmation efforts are ongoing. The investigation revealed incomplete data cleanup in Foundation's legacy WooCommerce store. While historical orders appeared redacted in the backend, database migration left old tables retaining copies of customer personal information, including refund records and abandoned carts accessible to attackers. Additionally, customer data from orders placed after the May migration to Shopify may have been compromised, as those records had not been manually redacted and automated deletion tools were not yet enabled at the time. Foundation has revoked affected email credentials, purged queued phishing emails, and taken related legacy services offline. The company confirmed there is currently no evidence that Passport devices or their private keys were impacted by the breach.