More reports across Reddit of users who either were supposedly not part of the 9,500 affected individuals from the previous data leak, or users who used unique email addresses for affiliation and marketing reasons, all getting targeted phishing emails. A little bit of digging also found this comment from a Ledger staff member:
Hello,
As soon as we discovered the data breach in July 2020, we patched it.
Since then, we lead two penetration tests with a third party consultancy to verify and improve the security of your data.
We did not encounter a new data breach since July.
As said in another post, two weeks ago, we've been made aware that some of our customers are being targeted by phishing attempts. Some of these customers were not part of the 9,500 individuals for whom we know that data other than email were also exposed, such as first and last name, postal address, phone number or ordered products. In the current state of our knowledge, It is not technically possible to state the exact scope of the leak of this detailed data.
Hope It helps.
So, in the absence of any evidence of a further data breach, it looks like the July data breach was much larger than they initially thought. It is more than a little concerning that they "cannot state the exact scope of the leak of this detailed data". They have no idea what has been breached.
Between the unpatchable Trezor vulnerability, and this extensive Ledger leak, I'm close to giving up on hardware wallets altogether. Most of my funds are on airgapped, encrypted, cold storage, but that just isn't an option for your average Joe, at least not until they've been involved in crypto for a while and understand the process and risks. What can we recommend for newbies that is more secure than a software wallet but still straightforward and easy to use?
And I'll repeat my advice regarding this kind of thing that I've said before: If you have given personal details, email addresses, name, telephone number, physical address, etc. to any crypto company, do yourself a favor and look at their Terms and Conditions and Privacy Policy and figure out how to request that they delete it.
