Breach Disclosure: Ledger

Ledger, a Hardware Cryptocurrency wallet provider experienced a data breach around June 25th, 2020 which impacted the e-commerce and marketing database, used for sending order confirmations and promotional emails. Ledger has acknowledged and addressed the breach, stating that payment information and crypto funds are safe, however, the database did expose email addresses as well as a subset containing first and last names, postal addresses, and phone numbers. The breach affected 1,075,381 accounts, with 272,852 customers PII exposed in the breach.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On July 29, 2020 Ledger released a statement detailing the breach, which was brought to their attention by a security researcher on July 14, 2020. The initial breach vector appears to be through an exposed API key, which has since been deactivated.

Earlier this month, new outlets began reporting that Ledger customers were receiving breach notifications saying that they needed to install a new version of Ledger Live and to reset their PIN. If the attacks had been successful, attackers would have been in full control of the user's cryptocurrency funds.

Initially this data was being sold on various forums and marketplaces, however, after becoming stale, numerous threat actors began listing the database for free.

Figure 1: Ledger advertisement

Figure 2: Ledger advertisement on RaidForums

In addition to the phishing emails, Ledger warned customers that attackers were demanding $500 in ransom to not invade the victims home. In total, there have been 171 phishing sites that have been shut down by Ledger.

Figure 3: Ransom email from attackers targeting Ledger customers