Foundation says leaked Cloudflare API keys were used to send phishing emails from its domain

AI-assisted source summary · not independently verified. Content standards

Foundation said at least one leaked Cloudflare API key was used to send phishing emails from its domain, and that it has revoked all API keys. The company said Passport devices and the Bitcoin, funds, and hardware in them were not affected, and that it is investigating the incident and will publish a report. Recipients said the emails contained names, addresses, email addresses, and purchase information, but Foundation has not said whether customer order information was accessed.