Ledger ledger.com Ledger data breach: what happened and what to do
Customer contact data for Ledger, the crypto hardware wallet maker, was exposed through a 2020 incident at its e-commerce provider Shopify. Have I Been Pwned lists 1,075,241 accounts, with emails, names, phone numbers and addresses exposed.
View all 13,115 breaches- Breach date
- 25 Jun 2020
- Made public
- 21 Dec 2020
- Affected
- 1,075,241
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Ledger makes hardware wallets for storing cryptocurrency. Its customer contact data was exposed in 2020 after rogue members of a support team at Shopify, which ran Ledger's online store, took merchant customer records. Have I Been Pwned (HIBP) gives a breach date of 25 June 2020, added it on 20 December 2020, and counts 1,075,241 accounts.
What happened
Shopify disclosed in September 2020 that two members of its support team were involved in taking customer data from fewer than 200 merchants. Ledger wasn't known to be affected at that point. According to reporting, Shopify discovered Ledger's involvement on 21 December 2020 and informed it two days later.
Ledger said 292,000 of its customers were affected by its own count, and a later forensic review found about 20,000 further records. HIBP's figure for the data that circulated is 1,075,241 accounts, which is the number to use here.
What was exposed
HIBP lists email addresses, names, phone numbers and physical addresses. Ledger said the exposed fields also included products ordered. It said the private keys of Ledger wallet users weren't affected, and Shopify said complete payment card numbers or other sensitive financial information weren't exposed.
What that lets criminals do
This is not a password breach, and a Ledger wallet's recovery phrase is not part of it. The danger is targeting. A list of crypto wallet owners with their names, addresses and phone numbers is useful to scammers.
Expect phishing emails and texts posing as Ledger, asking you to enter your 24-word recovery phrase on a fake site "to secure your wallet" or "to update firmware". Ledger will never need your recovery phrase. Anyone who asks for it is a scammer.
The physical address matters too. Someone who knows you own a crypto device and where you live may be tempted to send fake devices or try to approach you in person. That is rare, but it is why this data belongs in a personal-safety conversation and not only an inbox-hygiene one.
The company's response
Ledger added a bitcoin bounty and new data security measures after the incident, according to CoinDesk. It also faced a class action filed in April 2021 against Shopify and Ledger entities. The plaintiffs' claims are allegations, and the sources reviewed don't report a settlement.
If you bought a Ledger
Never type your recovery phrase into a website, app or email. If you get a message about your Ledger, close it and go to the company's website directly.
How to check your own exposure
Search your email address on Have I Been Pwned to see whether it appears in the Ledger entry. Then check your inbox for old messages from Ledger so you know what real ones look like: the sender address, the language and what they ask for. A real message from the company won't ask for your recovery phrase, and it won't rush you. If you're unsure whether an email is real, go to the company's own website by typing the address yourself and look for the same notice there.
What to do if you were in it
- 1
Never share your recovery phrase
No genuine Ledger message needs your 24-word recovery phrase. If a site, email or text asks for it, it's a scam. Close it.
- 2
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 3
Be careful with deliveries and strangers who know you own a wallet
Your name, phone number and address are in the data. Don't use a hardware wallet that arrived unexpectedly or came in tampered packaging, and be wary of anyone who contacts you in person about your crypto.
- 4
Use a unique email for crypto accounts
A separate email address for exchanges and wallets limits how much a leak of one list reveals about you.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Ledger data breach?
Check your email on Have I Been Pwned. HIBP lists 1,075,241 accounts. A Serus free scan checks your email and phone number against this and other breaches.
Were my crypto funds or recovery phrase exposed?
Ledger said the private keys of wallet users weren't affected. Contact details were exposed, not keys.
What was exposed in the Ledger breach?
Email addresses, names, phone numbers and physical addresses, according to HIBP. Ledger also said products ordered were included.
Is there a settlement?
A class action was filed in April 2021 against Shopify and Ledger entities. The sources reviewed don't report a settlement.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
