Foundation's review identified more than 23,000 phishing attempts and customer details in older store records, while the company continues to assess how many customers may be affected.
Mailgun was linked to 19,057 attempts and Google Workspace to 1,503, totaling 20,560. Those tallies fall short of the reported figure of more than 23,000, and some messages were not delivered.
Customer information remained in WooCommerce database tables after a migration, even though it appeared masked in Foundation's administrative interface. The review also found information in refund entries and carts for uncompleted orders. Foundation is examining whether information connected to orders placed after its May 2026 shift to Shopify was exposed.
In response, Foundation took associated legacy services offline and invalidated the email credentials tied to them. It reported finding no indication that Passport devices or their stored private keys were affected. The customer data investigation continues.
