New Ledger phishing mail targets individual users

[Coin-Keeper]

I was the proud receiver of this last round of emails too.  Thankfully its a throw away email on tutanota.

[1714851891]

1714851891

[1714851891]

1714851891

[Lucius]

Never received any messages/texts after the initial hack back in July/August etc... until I received the latest "We are sorry to tell you that due to the new KYC regulations, your hardware device has been deactivated." message 2 days ago.

I also received the first such message in an email a few days ago, but it was in a spam folder. The message itself is really a real joke, of course only for those who know that HW cannot be deactivated in the way someone is trying to present it.

Personally, I think the users saying "I got this message after buying on Black Friday" is just a timing coincidence... but that still doesn't change the fact that Ledger fucked up originally and haven't done a great job of handling it.

There is no doubt that a company like this should not have allowed itself something like this, but when the hacking of the database happened, what could have been done better than what Ledger is currently doing? What exactly would you do if you were in such a situation?

[Pmalek]

I really can't imagine that their server are still compromised, that would require some exceptionally bad incident response. Guess that's not impossible tho..

I don't think there are either. However, dkbit98 did share that reddit post where a user claims that he received a phishing email after purchasing one of their devices. But if the reddit user hasn't posted any proof to support his claims, the chance that he is lying and trying to take a swing at Ledger while they are down is equally possible.

I received the latest "We are sorry to tell you that due to the new KYC regulations, your hardware device has been deactivated." message 2 days ago. It wasn't even personally addressed, it just said: "Dear <my.email @address.com>"... so I'm not even sure if it was from the Ledger leak, or is just a semi-targeted campaign using details from one of the many crypto service hacks

I don't think it is related to the original leak. I received that device deactivated email as well, twice, on an email address not even remotely connected to the email used to purchase my Ledger device. It went into spam both times. I guess the senders just have a huge database of email addresses they have gotten their hands on.   

[jerry0]

I received this email as well but it went to my spam folder.  So most users thus received this email then?


So what happens if you click on the link on the email?  Is it malware/virus/keylogger?


Or does it ask you for your seed? 

[Lucius]

~snip~

It is mostly about trying to get someone to put their seed on a phishing site, but it is possible that this could infect your computer with a virus/malware. For you and most average users there is no point in clicking on a link, let’s leave that for those trying to locate hackers and prevent them from continuing with this dirty campaign.

[bob123]

I don't think there are either. However, dkbit98 did share that reddit post where a user claims that he received a phishing email after purchasing one of their devices.

Reddit users are... inexperienced to say at least.
Most of the people commenting there on crypto subs literally have not a single clue. These are the people who fall for phishing mails.

Just because some people on reddit claim something, this doesn't make it true. In fact, you should always assume that those people made the mistake themselves.

I guess there's always the possibility of something being overlooked (the baddies are always so ingenious), for example: man-in-the-middle attack or even some sort of 'inside job'. As in the recent twitter case.
They may not even know they are leaking data. Purely speculation on my part, of course...

A MITM is not related to that and wouldn't have any influence.

Whether it is an inside job or not, you do know when you are leaking data.
It's not something which "just happens" without being noticeable. There is enough evidence and there are definitely enough traces to see that data has been leaked and how it has been leaked.

[btcwish1]

Another phishing email today. It is just not stopping. I am worried about one thing. I didn't receive email about 'ledger live' before and I never used ledger live either.

But recently I installed ledger live and used ledger live.  Now I am getting phishing email about ledger live!!

[HCP]

Another phishing email today. It is just not stopping. I am worried about one thing. I didn't receive email about 'ledger live' before and I never used ledger live either.

But recently I installed ledger live and used ledger live.  Now I am getting phishing email about ledger live!!

It's most likely just a coincidence... a lot of people are receiving this "new" email.

Refer:
https://www.reddit.com/r/ledgerwallet/comments/kbtyix/data_breach_email/
https://www.reddit.com/r/ledgerwallet/comments/kbt4fv/so_wheres_the_attack_vector_in_this_email_theres/
https://www.reddit.com/r/ledgerwallet/comments/kbtpmq/ledger_data_breach/

And have a read of this: https://www.bleepingcomputer.com/news/security/fake-data-breach-alerts-used-to-steal-ledger-cryptocurrency-wallets/

[aesma]

btcwish1 : I've been using Ledger live for years and I just got the email too, for the first time. I must say it's well done, but not enough to convince me to change my PIN or whatever, I understand how the security of the Ledger works, and I also know there is no association between my email and my wallet.

It will definitely work on some people, I fear.

edit : and I didn't buy a Ledger since that one time years ago.

[Pmalek]

It has been 9 days since I created a brand new email address, registered for the Ledger newsletter, signed up to their Affiliate program, and entered my email address in their shopping cart as part of an uncompleted purchase. I have not received a single phishing email to the brand new account. If the data was still being leaked, I think someone would have tried something by now and I would have received a phishing email.

@dkbit98
What about you? Have you received any bogus emails?

@btcwish1
My friend, who my Ledger device was shipped to, received phishing mails, and I received some on email accounts that are not connected to Ledger at all. Who knows how these people operate and what kind of databases they have gotten their hands on. 

[dkbit98]

What about you? Have you received any bogus emails?

Nothing received yet on new email I created, but it is interesting that I didn't receive any legit email from Ledger also, even if I am subscribed to their newsletter, so maybe they shut it down totally I don't know 

I do keep getting daily scam messages on my old email address, some of them go directly to spam folder, but they always create new address that shows up in my inbox.
I reported recently in scam accusations that this scammers are from Ukraine/Russia region.

[suchmoon]

My friend, who my Ledger device was shipped to, received phishing mails, and I received some on email accounts that are not connected to Ledger at all. Who knows how these people operate and what kind of databases they have gotten their hands on. 

"they" might have cross-referenced the Ledger list with some other lists to farm more related contact info, or sold the list to someone else who did it. I went through my spam folder and found at least one Ledger phishing e-mail received at an address that I never gave to Ledger but it still refers to me by name. It is possible that some other unrelated leak somewhere contained my name and e-mail too but that's a hell of a coincidence that it got a Ledger-themed e-mail and not the usual genitalia enlargement promotions.

Given that every fucking scammer knows "here is an address of a person who might have a decent amount of crypto because they bought a hardware wallet" it's just a matter of time before they start targeting family members.

[LTU_btc]

Nothing received yet on new email I created, but it is interesting that I didn't receive any legit email from Ledger also, even if I am subscribed to their newsletter, so maybe they shut it down totally I don't know 

Nope, I'm still getting legit emails from Ledger. I got it on 7th, 12th December and another one just 10 minutes ago. So, it's a bit strange that you haven't got anything.
Also, recently I haven't got phishing Ledger emails, just some Blockchain.con and PayPal scams. But probably it's only matter of time.

[Pmalek]

Nothing received yet on new email I created, but it is interesting that I didn't receive any legit email from Ledger also, even if I am subscribed to their newsletter, so maybe they shut it down totally I don't know

They are still sending out those newsletters. I got my first one the day after I created my new email and registered for their newsletter. Maybe it is sent once a month or twice, and it just happened that I signed up the day before it was scheduled to be sent anyway.

...it's just a matter of time before they start targeting family members.

I would find that more troublesome than getting them myself.

[dkbit98]

Again I see people who recently purchased Ledger getting this phishing emails and sms from scammers.
Here is latest example from guy who purchased ledger just two weeks ago:

I just bought the Ledger two weeks ago. Now I am receiving a bunch of phishing emails I never got before from senders posing to be from Ledger.
I know there was a database breach a long time ago, but I just bought the Ledger X. Is there an inside employee leaking these emails? How can my email have been compromised within two weeks?

https://www.reddit.com/r/ledgerwallet/comments/kd6kbs/i_just_bought_the_ledger_two_weeks_ago_now_i_am/

And there are numerous reports on Legder not properly addressing tax, so people need to pay double taxes when they receive their wallet package.
What a joke  

Given that every fucking scammer knows "here is an address of a person who might have a decent amount of crypto because they bought a hardware wallet" it's just a matter of time before they start targeting family members.

Exactly, and they can sell all customer data to any local criminals and gangster if they want.

[aesma]

When you buy from a foreign country, outside of a trading block, duties are always tricky. I buy tons on cheap stuff on aliexpress and clearly nobody pays the taxes, it's just a game with the customs officer, sometimes you're caught and you pay.

A ledger being small they might go through fine most of the time.

[LTU_btc]

When you buy from a foreign country, outside of a trading block, duties are always tricky. I buy tons on cheap stuff on aliexpress and clearly nobody pays the taxes, it's just a game with the customs officer, sometimes you're caught and you pay.

A ledger being small they might go through fine most of the time.

Can you tell how phishing emails and taxes for goods is related?
Anyway, I think it's correct to compare Aliexpress and Ledger. When you buy from Ledger store, VAT is already added into final price. It depends on every seller what price they show on goods declaration and also it depends on customs of each country.
By the way, at least in Europe it won't be that easy to buy goods from China without paying taxes. From 2021, we will have to pay VAT for all goods from China, there will be no more exceptions for stuff which costs less than €22. Sorry if it's slightly off-topic .

[btcwish1]

Yet again another phishing email. This time in the name of new KYC rules!!

[aesma]

When you buy from a foreign country, outside of a trading block, duties are always tricky. I buy tons on cheap stuff on aliexpress and clearly nobody pays the taxes, it's just a game with the customs officer, sometimes you're caught and you pay.

A ledger being small they might go through fine most of the time.

Can you tell how phishing emails and taxes for goods is related?
Anyway, I think it's correct to compare Aliexpress and Ledger. When you buy from Ledger store, VAT is already added into final price. It depends on every seller what price they show on goods declaration and also it depends on customs of each country.
By the way, at least in Europe it won't be that easy to buy goods from China without paying taxes. From 2021, we will have to pay VAT for all goods from China, there will be no more exceptions for stuff which costs less than €22. Sorry if it's slightly off-topic .

dkbit98 just above my post was adding another accusation against Ledger, that they mess up with the taxes.  I'm French so when I ordered my Ledger through their website, there was really no customs involved (it's a French company).

Yet again another phishing email. This time in the name of new KYC rules!!

You really need to not understand what it is you have bought to fall for that one.

[FatFork]

Looks like we can expect a new stream of Ledger phishing emails.
The stolen database has become available for free on 'RaidForums'. Ledger confirmed.