Ledger(and Trezor) hardware wallet owners: heads up | EDIT: (debunked)

[mk4]

Ledger's(and Trezor's, KeepKey's and various other websites) customer database is rumoured to be leaked due to a Shopify exploit. Note: I'm putting a lot of emphasis on the word "rumoured" because there's also a good chance that this is fake. This is just a heads up.

Based on the screenshots, on Ledger's side, the database that's rumoured to be "leaked" include:

• names
• full addresses
• phone numbers
• emails

To see the screenshots of the apparently "leaked" database, take a look at the tweet itself: https://twitter.com/underthebreach/status/1264460979322138628

The only statements we have from Ledger and Trezor as of the moment:

Src:

• https://twitter.com/Ledger/status/1264506360735174657
• https://twitter.com/Trezor/status/1264547574377218048
• https://www.reddit.com/r/ledgerwallet/comments/gpswhu/the_ethereum_forum_hacker_is_now_selling_the/frohn7t/

In this case we can say that it's more unlikely for Trezor to be affected. One thing's for sure, don't take $5 wrench attacks lightly.

https://xkcd.com/538/

Will edit this topic when I find more updates.

EDIT 1: Alright ladies an gents, looks like we're done with this topic.

here's the article:
https://www.ledger.com/our-ecommerce-database-has-not-been-hacked

While we can all have our sighs of relief now, make this be a wake up call that it's heavily not recommended to be handing over personal information on a lot of websites. Always think twice when handing over personal information.

[crwth]

When there are statements from the official company, I think they are taking it seriously and are trying to find out if there is an actual breach of the database. Maybee after thorough investigations, the public would be informed as well. I think we will never know what happens behind the scenes if it's real or no, but the important thing is we should not interact with emails claiming ridiculous things right now.

Since their official website uses Shopify, everyone is affected who ordered from their site, right?

[ranochigo]

Doubt it is real, to be honest. It would fetch much more value if its sold elsewhere in the darkweb presumably. It's fairly useful for hackers to obtain such information; scamming through social engineering, selling to advertisers etc. I bet it could fetch much more than the asking price here. It would be better to be wary of any social engineering attempts though.

Good on Trezor for scrubbing their user info regularly, hope to see other companies do the same.

[mk4]

When there are statements from the official company, I think they are taking it seriously and are trying to find out if there is an actual breach of the database.

As they should. Time will tell.

Since their official website uses Shopify, everyone is affected who ordered from their site, right?

Apparently. I'm not giving this rumour that much credibility as Shopify hasn't made a statement yet, but it doesn't automatically mean that a leak didn't happen either. They might also just still be in the "investigations" phase. Again, time will tell.

Doubt it is real, to be honest. It would fetch much more value if its sold elsewhere in the darkweb presumably. It's fairly useful for hackers to obtain such information; scamming through social engineering, selling to advertisers etc. I bet it could fetch much more than the asking price here. It would be better to be wary of any social engineering attempts though.

I have my doubts too. But I don't think this is something we should just totally ignore.

[Bttzed03]

It feels kind of weird that they're selling hardware wallets that helps us protect our crypto funds from hacking is also maintaining a data base of its customers to a centralized server that's also hackable.

For those who still don't get the $5 wrench attack, this conversation might explain it better  

[mk4]

It feels kind of weird that they're selling hardware wallets that helps us protect our crypto funds from hacking is also maintaining a data base of its customers to a centralized server that's also hackable.

To be fair, most ecommerce stores or even websites in general(even the giant ones) use third party data centers anyway(Amazon AWS/MSFT Azure/etc), hence there's almost always going to be a third party trust involved, unless they run their own data centers.

[Bttzed03]

~
To be fair, most ecommerce stores or even websites in general(even the giant ones) use third party data centers anyway(Amazon AWS/MSFT Azure/etc), hence there's almost always going to be a third party trust involved, unless they run their own data centers.

Yeah, I get that. It's still weird.


Welp, it's not just Ledger and Trezor. Keepkey database is also reportedly compromised.

The hacker claims to be in possession of account information corresponding to nearly 41,500 Ledger users, over 27,100 Trezor users, and KeepKey’s 14,000 customers.

....and other crypto exchanges

The hacker is now advertising the databases of 18 virtual currency exchanges and forums, in addition to the email lists of two crypto tax platforms.

The databases include the full SQL for Korean exchange Korbit spanning 4,500 users, three databases for Mexcican trading platform Bitso, and the complete account information including passwords for blockchain platforms Blockcypher, Nimirum, and Plutus.

There's a high chance that this hacker is only trolling though.

[cheezcarls]

I haven't used my Ledger Nano S in Shopify or any e-commerce stores yet. Rumors are just "rumors". They're not confirmed yet. However, I do believe that hackers innovate no matter how hard it is to crack, especially hardware wallets.

Ledger Nano S and Trezor are some of the best, safe and secure wallets ever. If that "hacker" sells that database to the dark web, we could confirm if some certain users would see some unauthorized activity coming from their wallets themselves.

[crwth]

Good on Trezor for scrubbing their user info regularly, hope to see other companies do the same.

I don't know why they scrub their old customer database they might want to continue with their upselling or something related to that? I mean it's ideal for us as consumers to have our data be trashed but for companies to have that information because customers ordered previously is a gem. Customers are the lifeline of the company so why scrub? Hmm.

To be fair, most ecommerce stores or even websites in general(even the giant ones) use third party data centers anyway(Amazon AWS/MSFT Azure/etc), hence there's almost always going to be a third party trust involved, unless they run their own data centers.

It's going to be an expensive investment to run their own data centers, maybe when they get bigger as a company.


According to this article by Jamie Redman

https://news.bitcoin.com/hacker-attempts-to-sell-data-allegedly-tied-to-ledger-trezor-bnktothefuture-customers/

The Shopify system is not compromised, said in the article. I think that's what companies will all say if they are included in something remotely like this.

News.Bitcoin.com also spoke with a Shopify representative and the company said: “We investigated these claims and found no evidence to substantiate them, and no evidence of any compromise of Shopify’s systems.”

And another allegedly connected company is Keepkey. Stated as well in the article. Just like what Bttzed posted.

[guigui371]

It feels kind of weird that they're selling hardware wallets that helps us protect our crypto funds from hacking is also maintaining a data base of its customers to a centralized server that's also hackable.

To be fair, most ecommerce stores or even websites in general(even the giant ones) use third party data centers anyway(Amazon AWS/MSFT Azure/etc), hence there's almost always going to be a third party trust involved, unless they run their own data centers.

I don't really use PO boxes as they are small and many businesses don't want to deliver parcels to them.
But where i am, we have the choice to be delivered to nearby businesses, this can be a good option as the shipping address remains confidential to trezor/ledger  (unless you are dumb and provide them a "billing address with your real DOX).

One of the advantages is that said businesses (mainly groceries store) are open until 11pm every day. (unlike the post office that only do 9am to 4pm working days only).
I wouldn't do that for an expensive package, but for everyday low-value parcels it working quite well.


The $5 wrench attack is really hard to avoid, but every step that make it harder is a step in the right direction

[mk4]

I haven't used my Ledger Nano S in Shopify or any e-commerce stores yet. Rumors are just "rumors". They're not confirmed yet. However, I do believe that hackers innovate no matter how hard it is to crack, especially hardware wallets.

Ledger Nano S and Trezor are some of the best, safe and secure wallets ever. If that "hacker" sells that database to the dark web, we could confirm if some certain users would see some unauthorized activity coming from their wallets themselves.

You're completely missing the point here. The rumoured "leak" is not concerning the security your hardware wallet itself, but the personal information you've probably given them if you bought directly from them. What sites you've used your bitcoin doesn't matter in this case.

[ranochigo]

Good on Trezor for scrubbing their user info regularly, hope to see other companies do the same.

I don't know why they scrub their old customer database they might want to continue with their upselling or something related to that? I mean it's ideal for us as consumers to have our data be trashed but for companies to have that information because customers ordered previously is a gem. Customers are the lifeline of the company so why scrub? Hmm.

I mean, I don't trust any companies who would keep and sell my data, especially if it's any sensitive data and/or they are supposed to aid to keep my privacy.

It is definitely not necessary for companies to keep my home address or phone number. If they tries to sell those data to third party companies, I would have second thoughts about buying from them.

[cheezcarls]

I haven't used my Ledger Nano S in Shopify or any e-commerce stores yet. Rumors are just "rumors". They're not confirmed yet. However, I do believe that hackers innovate no matter how hard it is to crack, especially hardware wallets.

Ledger Nano S and Trezor are some of the best, safe and secure wallets ever. If that "hacker" sells that database to the dark web, we could confirm if some certain users would see some unauthorized activity coming from their wallets themselves.

You're completely missing the point here. The rumoured "leak" is not concerning the security your hardware wallet itself, but the personal information you've probably given them if you bought directly from them. What sites you've used your bitcoin doesn't matter in this case.

Okay I see and thanks for clarifying that to me. It's really concerning right now on how our personal information are getting exposed when we buy something in Shopify or other platforms that keeps our data. We could be victims of identity theft. Even if they assure that our personal data is safe and secure, we can't be complacent on that.

Privacy is something that we need to protect. It's really scary on how these hackers are finding new ways to "compromise" a platform, even if they're just rumours. As security improves, so as the hackers' brains to counter-attack.

[Ifra24]

I doubt this case, (Shopify is a ledger and trezor seller)  communications manager at Shopify e-commerce website, says:

"We investigated these claims and found no evidence to substantiate them, and no evidence of any compromise of Shopify’s systems."

But the TREZOR and LEDGER steps I think are correct. The company must act seriously to investigate. Because the good name and trust can be lost with this news. If this is the fault of the reseller, there can be an evaluation for Shopify.

Source: https://decrypt.co

[mk4]

I mean, I don't trust any companies who would keep and sell my data, especially if it's any sensitive data and/or they are supposed to aid to keep my privacy.

It is definitely not necessary for companies to keep my home address or phone number. If they tries to sell those data to third party companies, I would have second thoughts about buying from them.

We could definitely easily say that companies keeping your information is unnecessary, but let's not forget that the government likely(though I have no sources to give) requires businesses and companies to have a database of their customer's information. This is not a black or white situation.

[libert19]

I got my ledger through mew competition, so even if it's true, my details should be safe 

[joniboini]

Man, just a few weeks ago one of the biggest e-commerce databases that I use was leaked and now this. Still, assuming this is real, I'm not sure how they will select their victim. What a big joke if they come to one of the addresses, got the wallet, forcing the owner to tell the password but he doesn't have any funds left.

[UserU]

You're completely missing the point here. The rumoured "leak" is not concerning the security your hardware wallet itself, but the personal information you've probably given them if you bought directly from them. What sites you've used your bitcoin doesn't matter in this case.

Even for those who contacted support? They have to submit emails when creating support tickets.

[so98nn]

I never opened up my ledger after creating the backup for the initial set up.

So does it mean my data is still secure for my ledger ?

What I mean is, I never connected it with network till now after first set up.

Or is it like they have fetched the data from stored servers of ledgers or whatever storage location is there? Shall we afraid of our coins in the ledger ?

[Maus0728]

I never opened up my ledger after creating the backup for the initial set up.

So does it mean my data is still secure for my ledger ?

What I mean is, I never connected it with network till now after first set up.

Or is it like they have fetched the data from stored servers of ledgers or whatever storage location is there? Shall we afraid of our coins in the ledger ?

Your bitcoin and other altcoins are safe. The only thing you should worry is that the personal information you surrendered to the mentioned company are at risk of being compromised by illegal dealers in the blackmarket.

Your ledger and your crypto is not correlated from the data breach but your sensitive information when your bought your cold storage does. Your coins are safe unless there is a $5 Wrench attack,