Ledger Users Targeted In Phishing Scam Following Global-e Data Breach

Scam suspects use leaked order data to personalize messages, making emails more difficult to decipher.

Cybercriminals have reportedly launched a phishing campaign using a fake connection between cryptocurrency hardware wallet manufacturers Ledger and Trezor.

This follows a recent data leak at Ledger’s third-party e-commerce partner, Global-e.

Phishing Information

On January 5, Ledger disclosed to its customers via email that Global-e had suffered a data breach, exposing customer information, including names, email addresses, phone numbers and order details. Soon after the incident was made public, affected users began receiving phishing emails falsely claiming that the two companies were affiliated. Screenshots of non-shared communications on X.

“We are pleased to announce that after months of strategic discussions, Ledger and Trezor have finalized a merger agreement. This historic partnership brings together two industry leaders with a shared vision to provide the highest level of security for digital asset management,” the message read.

The email went on to say that this decision will allow the two companies to accelerate innovation, expand their product offerings, and continue their commitment to protecting customer assets. Recipients were also instructed to “port” their wallets by entering their 24-character recovery passwords on a fake website designed to mimic legitimate marketing.

In response to the attack, Global-e has reportedly launched an internal investigation into the hack and is working with cybersecurity experts to assess the scope of the incident. At the time, the company did not disclose the exact number of affected users but confirmed that the breach was limited to contact and ordering information.

It is reported that Ledger has also notified the relevant data protection authorities and is cooperating with law enforcement agencies.

History of Data Breaches

This episode is not the first time Ledger has been involved in such a scandal. In 2020, attackers also accessed its e-commerce and marketing databases, exposing the personal information of hundreds of thousands of users.

You may also like:

Exposed data includes email addresses, names, phone numbers, and residential addresses, and affected users later reported receiving phishing emails and threats. At the time, the wallet manufacturer faced public criticism for its delayed disclosures and inadequate safeguards, which led to a legal case being opened against it and Shopify.

The company later confirmed that a rogue Shopify employee was responsible for leaking the personal information of nearly 20,000 customers. This was followed by a separate attack later that year, in which the data of some 292,000 customers was published online.

Recently, the company faced another security incident, which resulted in the theft of an estimated $600,000 in cryptocurrency after a wallet drainer was installed in the library used by many decentralized applications to connect to their devices.