What leaked in Ledger data breach?

TLDR

Ledgers recent breach at its third?party partner Global?e exposed customer names, contact information, and some order details; private keys, wallet funds, and payment data were not accessed (report).

1. Exposed fields included names, emails, phone numbers, postal addresses, and order details such as order number, product, and price (order details).
2. Seed phrases, private keys, passwords, and card/bank data were not leaked, and funds remain safe (confirmation).
3. A targeted phishing wave followed, impersonating support and pushing fake migration steps to capture recovery phrases (phishing campaign).

Deep Dive

1. Data Exposed

The breach tied to Global?e affected personal identifiers and contact info for customers who bought devices through Ledgers store. Coverage highlights exposed names, emails, phone numbers, postal addresses, and order details (overview; addresses noted).

• Reports specify order metadata like order number, item purchased, and price paid (details).
• The number of affected users and full scope were not disclosed in initial alerts (media note).

2. Not Compromised

Wallet infrastructure and cryptographic secrets were not part of the breach. Reports consistently state private keys, seed phrases, on?chain balances, and payment credentials were untouched (confirmation; summary).

• Hardware devices and firmware remain secure; the incident is confined to a commerce partners data environment (analysis).

3. Phishing Risk

Attackers are already using leaked records to personalize social?engineering. Examples include emails claiming mergers and urging migration via fake sites to capture the 24?word phrase (case). Experts warn similar past Ledger data leaks enabled wallet takeovers and physical targeting, particularly when addresses were exposed (security guidance).

• Tactics: impersonated support, urgent security alerts, replacement device offers, SMS or phone follow?ups designed to lower defenses (guidance).

Conclusion

The breach exposed personally identifiable and order data via Global?e, not wallet secrets. The main risk is targeted phishing that exploits true personal details to trick users into revealing recovery phrases. Vigilance around communications and strict key?handling discipline are the actionable defenses supported by the reports above.