INVESTIGATION UPDATE 2
In our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers.
Across our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers.
Why the data was still there:
In our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached.
Addresses not in our records:
More than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from.
What we are doing:
Out of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted.
We have found no evidence that this incident compromised Passport devices or the private keys they hold.
Never enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.
We will continue sharing confirmed findings and publish our full report when the investigation is complete.
Foundation
npub1s0…npq6j
2026-10-26 19:07:37 UTC
Author Public Key
npub1s0vtkgej33n7ec4d7ycxmwt78up8hpfa30d0yfksrshq7t82mchqynpq6jPublished at
2026-10-26 19:07:37 UTCEvent JSON
{
"id": "b5b600f02fd9f91d12766ddf33008af2d109acd135a4a60d3635db815add1431",
"pubkey": "83d8bb23328c67ece2adf1306db97e3f027b853d8bdaf226d01c2e0f2ceade2e",
"created_at": 1793041657,
"kind": 1,
"tags": [],
"content": "INVESTIGATION UPDATE 2\n\nIn our last update, we said we would share how many people had personal information exposed once we could confirm it. We can now share those numbers.\n\nAcross our old WooCommerce store and our current Shopify store, records containing approximately 5,600 mailing addresses and 5,200 phone numbers, along with names and email addresses, were held in systems the attackers were able to reach. We cannot say for certain whether the attackers accessed all of these records, so we are treating all of them as potentially exposed. These records are a subset of our total customers.\n\nWhy the data was still there:\nIn our last update, we explained that copies of orders remained in old database tables after past migrations. We have since found that the 60-day redaction also did not cover every type of order, and that some customer details were stored in other parts of the store, such as abandoned carts and contact forms, that redaction never reached.\n\nAddresses not in our records:\nMore than 5,000 of the email addresses that received phishing emails do not appear in our WooCommerce or Shopify customer records. Some match our support and hiring inboxes. Together with reports of details that were never shared with us, this makes us confident the attackers also used data from outside Foundation. We are still tracing where these addresses came from.\n\nWhat we are doing:\nOut of an abundance of caution, we are rotating all keys and secrets across our systems, including those we have no evidence were accessed.We are keeping a single copy of the legacy WooCommerce data offline as evidence for the investigation. Once the investigation is complete, that data will be permanently deleted.\n\nWe have found no evidence that this incident compromised Passport devices or the private keys they hold.\n\nNever enter your recovery phrase into a website or share it with anyone, including someone claiming to be Foundation.\n\nWe will continue sharing confirmed findings and publish our full report when the investigation is complete.",
"sig": "706dbffb476e2903c241b3d5722f6eed8331979bae0ace881bbefe68b04dd9e6a1843539997bc2d3fd867a8f4f978cb053c5a35a665cc486ae602f7cfdf775f0"
}