Ledger Hardware Wallet Manufacturer Exposes Over 1 Million Customer Records
What Happened
In June 2020, Ledger — the maker of hardware crypto wallets — experienced a data breach that compromised personal information for 1,075,241 accounts. The stolen dataset, later sold and publicly dumped in December 2020, contained email addresses, names, phone numbers and physical addresses. The breach was disclosed to Have I Been Pwned by a cyber‑crime intelligence researcher.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous vendor‑risk monitoring that captures not just financial controls but also data‑privacy safeguards.
- Highlights the importance of maintaining defensible evidence of vendor security posture (e.g., third‑party audit reports, breach‑notification clauses).
- Reinforces that a control‑assurance program must verify that vendors have incident‑response and notification processes aligned with regulatory expectations (e.g., GDPR, CCPA).
Who Is Affected
- Cryptocurrency and fintech firms that rely on Ledger devices for custodial services.
- Consumers and investors using Ledger hardware wallets.
- Any organization that stores Ledger‑related customer data (e.g., support platforms, marketing databases).
Recommended Actions
- Review your exposure to Ledger‑supplied data and assess whether any of the compromised records intersect with your customer base.
- Validate that continuous monitoring controls (e.g., vendor security scorecards, breach‑feed integrations) are active and alerting on Ledger‑related incidents.
- Request a detailed incident‑response disclosure from Ledger and update your vendor‑risk documentation to reflect the breach’s impact.
- Ensure your own data‑retention policies limit the storage of unnecessary personally identifiable information (PII).
Technical Notes
- Attack vector: Unauthorized access to Ledger’s internal customer database (specific method not disclosed).
- CVEs: None reported.
- Data types exposed: Email addresses, full names, phone numbers, physical mailing addresses.
Source: https://haveibeenpwned.com/api/v3/breach/Ledger