I also received the first such message in an email a few days ago, but it was in a spam folder. The message itself is really a real joke, of course only for those who know that HW cannot be deactivated in the way someone is trying to present it.


There is no doubt that a company like this should not have allowed itself something like this, but when the hacking of the database happened, what could have been done better than what Ledger is currently doing? What exactly would you do if you were in such a situation?

I received this email as well but it went to my spam folder.  So most users thus received this email then?


So what happens if you click on the link on the email?  Is it malware/virus/keylogger?


Or does it ask you for your seed? 

Reddit users are... inexperienced to say at least.
Most of the people commenting there on crypto subs literally have not a single clue. These are the people who fall for phishing mails.

Just because some people on reddit claim something, this doesn't make it true. In fact, you should always assume that those people made the mistake themselves.




A MITM is not related to that and wouldn't have any influence.

Whether it is an inside job or not, you do know when you are leaking data.
It's not something which "just happens" without being noticeable. There is enough evidence and there are definitely enough traces to see that data has been leaked and how it has been leaked.

It's most likely just a coincidence... a lot of people are receiving this "new" email.

Refer:
https://www.reddit.com/r/ledgerwallet/comments/kbtyix/data_breach_email/
https://www.reddit.com/r/ledgerwallet/comments/kbt4fv/so_wheres_the_attack_vector_in_this_email_theres/
https://www.reddit.com/r/ledgerwallet/comments/kbtpmq/ledger_data_breach/

And have a read of this: https://www.bleepingcomputer.com/news/security/fake-data-breach-alerts-used-to-steal-ledger-cryptocurrency-wallets/

It has been 9 days since I created a brand new email address, registered for the Ledger newsletter, signed up to their Affiliate program, and entered my email address in their shopping cart as part of an uncompleted purchase. I have not received a single phishing email to the brand new account. If the data was still being leaked, I think someone would have tried something by now and I would have received a phishing email.

@dkbit98
What about you? Have you received any bogus emails?

@btcwish1
My friend, who my Ledger device was shipped to, received phishing mails, and I received some on email accounts that are not connected to Ledger at all. Who knows how these people operate and what kind of databases they have gotten their hands on. 

"they" might have cross-referenced the Ledger list with some other lists to farm more related contact info, or sold the list to someone else who did it. I went through my spam folder and found at least one Ledger phishing e-mail received at an address that I never gave to Ledger but it still refers to me by name. It is possible that some other unrelated leak somewhere contained my name and e-mail too but that's a hell of a coincidence that it got a Ledger-themed e-mail and not the usual genitalia enlargement promotions.

Given that every fucking scammer knows "here is an address of a person who might have a decent amount of crypto because they bought a hardware wallet" it's just a matter of time before they start targeting family members.

They are still sending out those newsletters. I got my first one the day after I created my new email and registered for their newsletter. Maybe it is sent once a month or twice, and it just happened that I signed up the day before it was scheduled to be sent anyway.



I would find that more troublesome than getting them myself.

When you buy from a foreign country, outside of a trading block, duties are always tricky. I buy tons on cheap stuff on aliexpress and clearly nobody pays the taxes, it's just a game with the customs officer, sometimes you're caught and you pay.

A ledger being small they might go through fine most of the time.

Yet again another phishing email. This time in the name of new KYC rules!!

Looks like we can expect a new stream of Ledger phishing emails.
The stolen database has become available for free on 'RaidForums'. Ledger confirmed.