Foundation says compromised Cloudflare keys were used to send phishing emails
The Passport maker says it revoked its API keys and took down the malicious domain, while asserting that customer funds and hardware remain safe.
By Ryan Merket · Published
Primary source: x.com
Why it matters
Foundation sells hardware meant to protect sensitive digital decisions. Its account says the incident reached email and domain infrastructure, not Passport devices or funds; the promised incident report will define the scope of the operational failure.
Foundation said on October 26th that spam emails appeared to come from its official domains, tracing the activity to one or more compromised Cloudflare API keys. The Boston hardware-security company said it revoked all of its API keys and had the malicious domain used in the emails taken down. It said funds stored on its Passport devices were safe and the hardware was not compromised.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.