Ledger Promises Funds Insurance As Client Data Leak Expands (UPDATED)

Bitcoin Hack Hardware wallet Ledger Privacy Security

Ad Disclosure

Ad Disclosure

We believe in full transparency with our readers. Some of our content includes affiliate links, and we may earn a commission through these partnerships. However, this potential compensation never influences our analysis, opinions, or reviews. Our editorial content is created independently of our marketing partnerships, and our ratings are based solely on our established evaluation criteria. Read More

Author

Linas Kmieliauskas

Linas Kmieliauskas

Author Categories

About Author

Author Profile

Share

Copied

Last updated:

June 26, 2023 06:54 EDT

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

Ad Disclosure

We believe in full transparency with our readers. Some of our content includes affiliate links, and we may earn a commission through these partnerships. Read more

France-based major crypto hardware wallet manufacturer Ledger confirmed that Shopify hackers obtained Ledger customer personal information in April and June 2020. (Updated at 14:01 UTC: updates throughout the entire text.)

“Along with forensic firm Orange Cyberdefense we were able to establish that it affects approximately 292,000 customers. While the database is 93% similar to those exposed in the previous attack there were approximately 20,000 new customer records including, email, name, postal address, product(s) ordered and phone number included in this breach,” the company said, adding that if you purchased a Ledger product after the end of June, 2020, or if you purchased your product outside of Ledger.com, your data was not exposed in these incidents.

“On December 23rd, 2020 we received a notification from our e-commerce service provider, Shopify, regarding an incident involving merchant data in which rogue member(s) of their support team obtained customer transactional records, including Ledger’s,” the company said on January 13, after completing forensics with Orange Cyberdefense.

According to them, Shopify claims that this is related to the incident reported in September 2020, which concerns more than 200 merchants, but until December 21st, 2020, Shopify had not discovered that Ledger was also targeted in this attack.

In May last year, Ledger denied claims that their databases have been compromised via a Shopify exploit. “We haven’t found any proof that this claim is legitimate,” they said back then.

Meanwhile, the company said today that they will “soon release a technical solution that will remove the 24 words as the single pillar of the security of our hardware wallets and will open the door to funds insurance for individual customers.”

In the meantime, they urged to “NEVER SHARE YOUR [SEED] 24 WORDS WITH ANYONE.”

Also, the company said that they notified the French Data Protection Authority on December 26th.

“We continue to work with Shopify and prosecutors on the case; an investigation is already underway, led by the FBI and the RCMP. Ledger also reported the events to the French Public Prosecutor and filed a complaint against the rogue agent(s),” they said, adding that they’re also hiring additional private investigation capacity.

Also, the company announced an initial BTC 10 (USD 346,173) bounty reserve for new information that woul help prosecute the attackers.

As for the next steps, Ledger said they’re “changing the way we handle this data, to go above and beyond GDPR principles”:

1. “We aim to put your e-commerce order information such as name, address, phone number in a segregated environment three months after the shipping of your product.”
2. “We will be deleting the name, address, and phone number from the order confirmation emails we send to you so this data does not pass through our ecommerce email provider.”
3. “We will implement a messaging model where proactive important security and technical information will be solely conveyed through Ledger Live.”

Also, they promised to re-assess all their suppliers and partners.

__
Learn more:
The Ledger Saga: Death Threats, SIM Swaps, Lawsuits & No Reimbursements
Trezor December Sales Were ‘Off the Charts’
Crypto Security in 2021: More Threats Against DeFi and Individual Users