Foundation revealed that a phishing campaign targeting Passport hardware wallet users stemmed from compromised Cloudflare API keys. Customer metadata was exposed, but user funds and hardware remain completely safe.