I also got the fake email, which contained my accurate contact information. The fake email was obviously a phishing attempt. The email address it was sent from looked legit enough, but hovering over the links in the email were a dead giveaway:
The fake arrived last night, but I didn't notice it until the official response had already been by Foundation. Here's what it says:
Hi,
Over the past few hours, some customers received emails that appeared to come from official Foundation domains. These emails were not sent by Foundation. Please do not click any links in them or reply to them.
Your Passport is safe. Funds stored on Passport are safe, and Passport devices are not compromised.
What we know so far
Attackers gained access to part of our backend infrastructure through a vulnerability in a self-hosted application.
They were likely able to access our customer support inbox, and they were able to send emails that appeared legitimate.
Within 10 minutes of the first reports, we shut down their ability to send emails and removed them from our systems. We have revoked all API keys, and the malicious domain used in the emails has been taken down.
Some of these emails included customers’ mailing addresses or phone numbers. We’re aware that people who have never ordered from us have also received them, so it’s likely the attacker is combining information from several recent data leaks before sending. We believe some details may also have come from access to our customer support inbox and possibly from recent orders on our new Shopify store.
Please stay vigilant
So, it appears their mail server (among other things, possibly,) were hacked. The hackers used their mail server to send the emails, which is why they looked like they came from a legit email address.
