Ledger 1 Mln Users Data Under Attack

[Kakmakr]

Do not worry !!!   Your BitCoins are absolutely safe, nothing to see here     Yes, they know EXACTLY what the hackers got, and are being TOTALLY HONEST about it  

Everyone can sleep well and not worry, they will take good care of you !!!

Hard Facts

Wrong, so so wrong.

When information like your email address and also your physical address are compromised, you are vulnerable to several kinds of attacks. Let me give you some examples:

1. Phishing attacks : Now that these people have these email addresses, they know who owns Ledger hardware wallets and they can customize specific attacks just for that individual. It will look very legit, because only the company would have known your personal data.

2. You are also vulnerable to physical attacks, because these people know your physical address and they might come to visit you, if they live in the same country.

This is much bigger than what Ledger is making it out to be, luckily for me I never store any coins at my physical address.. so they will not find anything at my home address. 

[Wind_FURY]

I believe we can also have a different, a more positive perspective from the hack. There are 1 MILLION BITCOIN USERS/HODLERs with Ledger wallets. MORE with other wallets. That's bullish.

[witcher_sense]

I am requesting a complete guide on how to buy hardware wallets in most possible secure way. For example, it could include the information regarding how to properly register on website, recieve wallets, how to pay for them without exposing your real identity to undesirable third parties. Should we use temp email addresses and temp credentials for that? How to recieve packages anonymously? What is the best way to do that? Should we use properly mixed coins for buying hardware wallets? Please note, the only goal of all of that is to preserve our privacy, safety, financial sovereignty, it should not be used to facilitate any illegal activities.

Does anyone have some information on what the more detailed email contains for one of the 9,500 that have been affected? I assume it is something along the lines of your personal data was one of the few taken, blah blah blah, investigators are on the case, etc etc.

There is no information on whether the 9.500 customers that have had their personal data breached, have or have not been explicitly notified of this fact.

They specified this on Twitter:

If you are part of the approximately 9500 customers whose detailed personal information - name surname, postal address or phone number - were accessed by the unauthorized third party you have been notified 30 minutes ago.

I guess you can breathe easy if you haven't received an email specifying that you were part of the smaller breach.

[cryptomaniac_xxx]

And Trezor trolling, LOL,



https://twitter.com/Trezor/status/1288463431750885383

[Zackgeno96]

Ledger Hardware Crypto Wallet Team Disclosed Data Breach, 1 Mln Users' Data Under Attack
A third-party attacker accessed the segments of e-commerce and promotional databases holding the email addresses of customers.
Additionally, 9,500 users were exposed to a leak of order details: name, street address, phone number and the details of what they ordered.

Now a lot of customers will be getting spam in their inboxes about new updates of the wallet along with the links to download those updates. I have seen this a lot of times when the spammers use these data breaches to send the spam mails and the ignorant users fall in these traps pretty easily.

Should we use temp email addresses and temp credentials for that? How to recieve packages anonymously? What is the best way to do that? Should we use properly mixed coins for buying hardware wallets? Please note, the only goal of all of that is to preserve our privacy, safety, financial sovereignty, it should not be used to facilitate any illegal activities.

Temporary mails aren't necessary, you can create a separate email for this purpose only. You can have those packages dropshipped and then that service can send you the package after receiving it.
I prefer to send my bitcoins to an exchange which doesn't require any KYC and then let them stay there for a week or two before ordering anything and then send those coins to a new wallet while using proxies or a VPN and then send the bitcoins for ordering what I was about to order. By doing this I satisfy my paranoid nature of leaking any information online.

[carlisle1]

Ledger Hardware Crypto Wallet Team Disclosed Data Breach, 1 Mln Users' Data Under Attack




https://cryptocomes.com/news/ledger-hardware-crypto-wallet-team-disclosed-data-breach-1-mln-users-data-under-attack

Good that ledgers action is faster than what their clients need.
imagine  the safest  wallet  in  the  world is under  attack?this is much stupid action from this hackers.

I believe we can also have a different, a more positive perspective from the hack. There are 1 MILLION BITCOIN USERS/HODLERs with Ledger wallets. MORE with other wallets. That's bullish.

and this is only proving that everything in crypto is a target.but i'm sure this will never happen again and  with 1 minute breach they can do anything  under the sun.

if your email is leaked, expected to see alot of spam investment offer on your inbox 

In times like these, I wouldn't mind multiplying my Bitcoin with the likes of Elon Musk

And  seeing the advertisement in youTube from time to time?lol

[LeGaulois]

...At the same time, I don't think its necessary for Ledger (or any other hardware wallet manufacturer) to keep sensitive information of their customers for long periods of times. I would have expected information to be scrubbed regularly.

I can think of a couple of reasons, the company's accounting since it is supposed to record everything (payment details,date, and so on). And in France companies must conserve such information for a 10-year period.

But also simply to be able to provide assistance to the customer. I mean for example if you have to be reimbursed for your wallet (for x reason), they have to keep a trace of your order (including your name, method of payment or other).

Otherwise how else could they be sure that you actually bought it on their store and not on Amazon for exemple.

[bitcoinst]

That's specifically what the leaked information would be used for. Given the sensitive information being leaked, attackers could potentially use the information to craft a more personalised phishing emails for the victims. Even if it isn't, the sensitive information could also be used in SE attacks against companies.

Phishing is phishing, whether targeted or spontaneous.
You can fall for phishing only through your own fault, no matter how clever it is. We have all the tools to check any link or any information that comes to your email.

Fortunately, the data breach is not that severe, only impacting their merchant information. At the same time, I don't think its necessary for Ledger (or any other hardware wallet manufacturer) to keep sensitive information of their customers for long periods of times. I would have expected information to be scrubbed regularly.

Logically yes, but in practice we don't know what Ledger does with our data. Some of the employees may sell the database, or the company's shadow policy itself may correspond to this.
We cannot know this, so it is useful to assume such things. Too many companies sell their customer data to others.

[Lucius]

And Trezor trolling, LOL,



https://twitter.com/Trezor/status/1288463431750885383

There is a saying that it is not nice to look forward to someone else's misfortune, because sooner or later the same thing (or something worse) can happen to you. But those who follow the relationship between the two companies know that business competition has long since become more than that. In any case, a good marketing move.

I believe we can also have a different, a more positive perspective from the hack. There are 1 MILLION BITCOIN USERS/HODLERs with Ledger wallets. MORE with other wallets. That's bullish.

We've known this before, according to the Ledger website 1 500 000 Ledger wallets already sold, but given the several different devices the company has produced, some have bought more than one - so the number of unique users is probably less than 1 million (regardless of the 1 million email addresses that were stolen).

[wxa7115]

People have been saying "just buy a hardware wallet" for a long time, but it has always been less than a perfect solution, because some centralization and trust has always been involved, and now it was abused. Now potential burglars and kidnappers have a list of people who own some bitcoins, and something like this will never happen with a software wallet, because it doesn't ask you for your personal information during installation.

IMO and old PC with live OS like Tails is the best cold storage you can get.

The safest option is by far a paper wallet, if you have a clean OS that is never connected to the Internet and a dumb printer then you could print your wallets with no issue, the problem is that they are very impractical for daily use but you could always have a wallet with some funds for your daily expenses.

Hardware wallets were supposed to be the best of both worlds, a device that was completely secure and that you could use whenever you want, but now that we have found out that ledger does keep the information of their clients for who knows how long that certainly weakens the security aspect of it and you are probably better off with a paper wallet until ledger and other hardware wallet providers change their policies regarding their data retention practices.

[hatshepsut93]

The safest option is by far a paper wallet, if you have a clean OS that is never connected to the Internet and a dumb printer then you could print your wallets with no issue, the problem is that they are very impractical for daily use but you could always have a wallet with some funds for your daily expenses.

Hardware wallets were supposed to be the best of both worlds, a device that was completely secure and that you could use whenever you want, but now that we have found out that ledger does keep the information of their clients for who knows how long that certainly weakens the security aspect of it and you are probably better off with a paper wallet until ledger and other hardware wallet providers change their policies regarding their data retention practices.

I think the phrase "paper wallet" is very misleading, because paper is just a method of storing the private key. You can't use paper to send Bitcoin or create a new address. You'll always end up using a software or hardware wallet to use the coins stored on paper. So, there's really only 2 kinds of wallets - software and hardware. "Paper wallets" can be created with both kinds.

"Paper wallets" also have some downsides, especially for newbies - a lot of them are offered via websites, and websites can't be audited as well as open source software from a repository. This is why one of the sites that offers paper wallet creation is malicious and steals users funds, but it was hard to prove.

[The Cryptovator]

I have noticed this story from the email notification yesterday. It was quite surprising to me from such as a reputed crypto wallet company. Because crypto users use the Ledger wallet to keep their fund safe and protect their privacy as well. So if they can't keep safe user's privacy then it's really regrettable for us. But the good thing is they disclosed the issue in front of their users instead of hiding or misled. So the user could determine what they should do like change credential. But not expected it from Ledger.

[pixie85]

You make a very good point here which is being missed by most posters.

To bring up a similar case of compromised email. Bitmain was hacked and thousands of customers emails home addresses and gear purchased was leaked.

I purchased 100 plus pieces of bitmain gear. Does that hack mean many people will come to my home?
Not likely.   But if I owned a ledger I would not have all my coins on it any more.

Of course nobody is going to come after you because they wouldn't know where to look. You could be a retailer or a middle man for some mining farm owner. Most likely the gear wouldn't even be at your house, same as Bitcoins. Even if they had all the dates of purchase, in this business 6 months is a lot of time.

Thinking like that would make every celebrity or a successful CEO live in a bunker and have bodyguards patrolling the garden 24/7. All rich people would have to live like one of those cocaine bosses from South America.

I don't have all my coins on my Ledger, but I feel pretty safe knowing that the private keys are unaccessible. Probably the weakest point is the software from Ledger that you install on your PC to access the wallet.

[kawetsriyanto]

Ledger Hardware Crypto Wallet Team Disclosed Data Breach, 1 Mln Users' Data Under Attack

Even Ledger, which is considered very safe, still has a gap to hack. of course they are not ordinary hackers but really professional so they want to test their skills. grateful if the Ledger quickly gets the information and immediately handle it. But it does not rule out the possibility that hackers will return with a more violent attack. therefore, in this case, Ledge has certainly learned from previous difficulties. And they will be even more active in covering the security of their hardware.

[UserU]

And  seeing the advertisement in youTube from time to time?lol

You mean those giveaway videos? I hardly come across those, but there are some ads with a self-claimed "marketing guru" who keeps telling the viewers to stop watching YouTube videos and start making money on the Internet. That one is annoying as hell.

[bbc.reporter]

Now we're going to hear news that people getting robbed and threatened to hand their ledger and the keys.  

You think that someone will break into your house and attack you because they know you bought a ledger? Most of ledger users have more valuable stuff in their houses than on their wallets. How are you going to know if:

The buyer bought it for themselves and not to give away or sell?
The buyer holds a lot of coins?

You could end up breaking into someone's home and risking getting shot or stabbed to learn that they sold it, gave it to a friend or have just $1000 or something like that in cryptocurrencies. The wedding rings most people have on their fingers all the time can be worth more than that.

I have a ledger and it wasn't bought on their site so I don't care.

You make a very good point here which is being missed by most posters.

To bring up a similar case of compromised email. Bitmain was hacked and thousands of customers emails home addresses and gear purchased was leaked.

I purchased 100 plus pieces of bitmain gear. Does that hack mean many people will come to my home?
Not likely.   But if I owned a ledger I would not have all my coins on it any more.

There is also another form of an old, public information source where criminals can take your name, address and phone no. and it is readily available.



This is a telephone directory. It never caused anyone to break into houses hehehe.

[Yaunfitda]

I remember @mk4 post here, Ledger(and Trezor) hardware wallet owners: heads up | EDIT: (debunked). And as per update, they say that they are not hacked and that this rumour is not true. But I think this is the the same breach reported in May. Not very good for Ledger image here, sad to say. They should have admit it right away and not they are looking very shady because of this move.

[mace15]

I have noticed this story from the email notification yesterday. It was quite surprising to me from such as a reputed crypto wallet company. Because crypto users use the Ledger wallet to keep their fund safe and protect their privacy as well. So if they can't keep safe user's privacy then it's really regrettable for us. But the good thing is they disclosed the issue in front of their users instead of hiding or misled. So the user could determine what they should do like change credential. But not expected it from Ledger.

I have also received an email the other day that they are having trouble about ledger wallet that data is under attack. This is the first time I have also heard that a reputable wallet experience this kind of problem. Though I’m also using this wallet for long and I haven't encountered any problem during these times of storing my crypto asset in this wallet. So let's always watch out the news from ledger as this has also many users will be affected.

[Wind_FURY]

And Trezor trolling, LOL,



https://twitter.com/Trezor/status/1288463431750885383

Hahaha! Or another good security practice could also be, to back up e-shop database to an offline database, then purge their e-shop database after less than 90 days.

[erikoy]

This is very bad to all expose users data. It can be use in criminal activities of the scammers. There are many of this kind of activity especially in social media like facebook copying details of others and then use it for scamming.

This breach likely has its purpose and there is so many wa it can be use. Hopefully that it can't affect innocent users on their criminal activities or even scamming the user through block mailing and other forms. And also that the responsible for hacking will get caught.