Attackers hijacked Foundation’s email infrastructure and sent fake hardware-wallet recall notices containing customers’ real names, addresses and purchase details.