Foundation said spam emails that looked like they came from its official domains were sent after one or more Cloudflare API keys were compromised, in a post on Oct. 26 (post).

Foundation said spam emails that looked like they came from its official domains were sent after one or more Cloudflare API keys were compromised, in a post on Oct. 26 (post).

The company said it revoked all API keys and that the malicious domain in the spam email was taken down.

It said funds stored on Passport are safe and Passport hardware is not compromised, and promised a report ASAP (post).

The Defiant reported that recipients flagged personal details and past purchases appearing in the messages, while the source of customer details remains unclear (article). Cointelegraph also flagged the alert the same morning (post).