Yup, this is horrendous. The leak of 9,500 addresses was bad enough. The leak of 272 thousand addresses is horrendous. But that isn't even the worst thing. Ledger either lied and covered up the size of this leak, despite endless customer reports to the contrary, or were genuinely unaware of what data had been accessed, and this lasted for months. Either is inexcusable and unforgivable. There is zero trust left with Ledger.

I'm done with hardware wallets. I was done with Trezor after their critical vulnerability which they don't even warn new users about, and now I'm done with Ledger since they can't be trusted to be either competent, honest, or both. I am completely unaffected by this hack thanks to fake credentials, but I refuse to use my Ledger devices any longer. I'll be moving everything off them and in to airgapped cold storage as soon as the mempool empties.

Lots of reports on Reddit of people receiving ransom emails with their real name and address, and demanding payment to not be physically attacked. Horrendous.

---

As I've said before, if you have given your real name and address to any crypto company, now is a good time to contact them and request that they delete all of your information. Check their Terms of Service and Privacy Policy for how to go about doing so.

When I told all the ledger shillers here that ledger team lies about 9500 number of full leak data, they told me I was wrong and to just trust the ledger. I don't see them now maybe because they got back into their small holes and hide.

Btw I think this download file you provided contains only emails and I can't find my email address there, but just to be safe I will probably change addresses I use.
EDIT: I found all other files also.


They lied 100% like I said many times before, and anyone who have any contacts in darkweb could confirm this.
Zero trust confirmed and reputation ruined.
Here comes 100% discount from ledger soon...

They are claiming on Reddit that they did not lie, and the logs and investigation they performed revealed only 9,500 compromised addresses. As I said above, if they aren't lying then they are completely unaware about the security of their own systems, and someone managed to steal a quarter of million customers' details with Ledger being none the wiser. Not that it really matters - either is enough to never use them again.

Use your browser's search-on-the-page feature to find your e-mail. Or save that file and search with any text editor.

Makes the recent complains about ongoing leaks not that far fetched anymore, doesn't it.

---

I checked a few zip codes around me and what do you know - the number of ledger buyers per zip code follows known indicators of wealth for those areas, e.g. income and real estate prices. This might turn out to be a very valuable dataset for a wannabe burglar.

A lot of posts ago, I mentioned that I was seeking legal advise. I have contacted my national data protection agency and I'm waiting for an update; although I'll have to update them on this one new discovery first... I'm posting some updated back in the local spanish board, but if there's enough interest, I can also bring the most important developments here too.

I'm not seeking a personal financial compensation (although that'd be neat); but at least I'd like to see a huge fine addressed to them

Who knows, they are close sourced; something that has been vastly criticized; and maybe somewhere in the code, the device sends a report on the assets each device cointains everytime you use Ledger Live. I wouldn't be surprised if such a thing was exposed right know; considering how crazy it's been since July.

I have always mentioned that the vulnerability was disclosed in July, but that we don't know how long it's been exploited; even if Ledger did delete the data after a certain amount of time, if hackers had access prior to that, well, we know how it follows.

It doesn't have to be in Ledger data. If there is a leak of e-mail addresses from somewhere else, e.g. some bitcoin forum perhaps, and those e-mail addresses can be tied to assets, and you can look up a physical address in the Ledger leak - jackpot. Granted that's a lot of work with a low probability of success but someone somewhere will surely try it and will release a nicely collated list of targets just because they can.

Ummm, that is how us paranoid security nutjobs think everyone stores our info.
This is why I use disposable email addresses and have semi-bogus shipping info.
Oh, and enjoy calling my virtual phone number that goes nowhere.
Sad, but this is what it takes to be somewhat secure today.

-Dave