Ledger database leak --> Phishing

[Poker Player]

I could see the data and I'm happy that my personal details are not in the documents leaked. Maybe because I bought the Ledger a few years back? My email is there but I already knew that. Also, I don't hold a lot of bitcoin but I would feel uneasy if I knew my full name and address had been leaked.

[1714892932]

1714892932

[1714892932]

1714892932

[1714892932]

1714892932

[1714892932]

1714892932

[1714892932]

1714892932

[UserU]

Was it categorized under Spam? I received 2, most probably the one you quoted earlier but I didn't want to click on either because of the compromise.

Mine went to the Spam folder (also from noreply@ledger.com).

I already received 2 phishing emails since yesterday. One of them from "Ledger Alerts", asking me to do a KYC to "unlock" my wallet. =/

Same, I noticed one had a bunch of strings attached (xxxxxxx.no-reply@ledger.com) and the other was just no-reply@ledger.com.

Now those people are gonna have a field day spam calling and emailing the hell out of us.

[Pmalek]

Just use link from GitHub posted by xoso, click on Ledger.rar -> Go to file -> Click on View Raw and there you can search in buyer txt file or All emails file inside your browser by using CTRL+F.

Do you mean that you can view the contents of the file without actually downloading and extracting it on your computer? I couldn't do it the first time. When I clicked on 'View Raw' it said that the file is too big and automatically initiates a download. I don't feel like downloading something from a user I don't know. Now it also seems that xoso's post got deleted.

[Rikafip]

Do you mean that you can view the contents of the file without actually downloading and extracting it on your computer? I couldn't do it the first time. When I clicked on 'View Raw' it said that the file is too big and automatically initiates a download. I don't feel like downloading something from a user I don't know. Now it also seems that xoso's post got deleted.

@btcltcdigger shared the list in our local board, so no need to download anything.

Skinuo sam ja.
Imas ovdje sve https://realt.services/ledger/

Luckily I am not among those with personal details leaked, and I am sure it isn't fun at all seeing your name, address and even phone number. My email is leaked though, but no spam as of yet.

[hilariousetc]

I could see the data and I'm happy that my personal details are not in the documents leaked. Maybe because I bought the Ledger a few years back? My email is there but I already knew that. Also, I don't hold a lot of bitcoin but I would feel uneasy if I knew my full name and address had been leaked.

It probably depends on whether you asked them to store your details or not. The hack happened in June 2020, and they said 1 million email addresses were leaked but only 10k users personal details were included (addresses, phone numbers etc).

Just use link from GitHub posted by xoso, click on Ledger.rar -> Go to file -> Click on View Raw and there you can search in buyer txt file or All emails file inside your browser by using CTRL+F.

Do you mean that you can view the contents of the file without actually downloading and extracting it on your computer? I couldn't do it the first time. When I clicked on 'View Raw' it said that the file is too big and automatically initiates a download. I don't feel like downloading something from a user I don't know. Now it also seems that xoso's post got deleted.

Same thing happened to me, but I managed to view it in the end. My details aren't on there thankfully, but I got emails from Ledger saying my details were included. Not sure what's going on.

Luckily I am not among those with personal details leaked, and I am sure it isn't fun at all seeing your name, address and even phone number. My email is leaked though, but no spam as of yet.

Yeah. A lot of people from this forum could be exposed if they used the same email address they used to sign up to the forum. I wonder if any real world robberies will be attempted because of this? It's really not a nice thought to think that nefarious individuals will have your address and phone number and know that you're involved in bitcoin in some capacity. I guess it would be hard to target idividuals because you don't know whether they have 1 dollar in bitcoin or millions.

[GrosWesh]

Same thing happened to me, but I managed to view it in the end. My details aren't on there thankfully, but I got emails from Ledger saying my details were included. Not sure what's going on.

fortunately you seem not to be on 'full data' list (name+add etc...). A second db provides tons of mails that were linked to ledger in another way (mostly newsletter).

[Marvelman]

Yeah. A lot of people from this forum could be exposed if they used the same email address they used to sign up to the forum. I wonder if any real world robberies will be attempted because of this?

Reportedly, there are some users on Reddit who have received personal threats and ransom emails based on the personal information exposed. A very disturbing thought.

Lots of reports on Reddit of people receiving ransom emails with their real name and address, and demanding payment to not be physically attacked. Horrendous.
[snip]

[Rikafip]

I wonder if any real world robberies will be attempted because of this? It's really not a nice thought to think that nefarious individuals will have your address and phone number and know that you're involved in bitcoin in some capacity. I guess it would be hard to target idividuals because you don't know whether they have 1 dollar in bitcoin or millions.

To be honest, I would be surprised if that didn't happen, dodgy characters checking list and trying to find people from their cities/neighbourhoods etc. Their line of thinking could be something like this "If he bought hardware wallet, that means he has decent amount of crypto, as why else would he invest in one if he has few hundreds of dollars worth of crypto". Add on that current bitcoin price, so you don't need to have 10 or 20 BTC in order for someone to try something stupid.

It's been never easier to track someone, with all those social media platforms where people share every aspect of their lives. Where they work, where they drink, where they eat etc..

[hilariousetc]

Same thing happened to me, but I managed to view it in the end. My details aren't on there thankfully, but I got emails from Ledger saying my details were included. Not sure what's going on.

fortunately you seem not to be on 'full data' list (name+add etc...). A second db provides tons of mails that were linked to ledger in another way (mostly newsletter).

Yeah, maybe, but I have ordered from them before so not sure why they would only have my email.

Yeah. A lot of people from this forum could be exposed if they used the same email address they used to sign up to the forum. I wonder if any real world robberies will be attempted because of this?

Reportedly, there are some users on Reddit who have received personal threats and ransom emails based on the personal information exposed. A very disturbing thought.

Lots of reports on Reddit of people receiving ransom emails with their real name and address, and demanding payment to not be physically attacked. Horrendous.
[snip]

As nasty as that is I think most of them will just be hollow threats hoping they can spook you into paying them. It's like the spam blackmail emails you get asking for payment to not release the webcam 'footage' they apparently have on you. Obviously there is no footage but they're hoping people will be worried enough and just cough up the money. I would advise anyone getting any of these sorts of emails to just ignore them. Maybe change your phone number or just block the numbers if they're getting nuiscans calls and texts but these attacks will probably die down quite quickly. Your data will always be out there now though so might be best getting a new number and email if you're worried.

Hopefully this is a warning/wake up call for everyone that your data is never truly safe with any third party and to take extras safety measures to prevent your details in case they are ever leaked like this.

[Lucius]

Do you mean that you can view the contents of the file without actually downloading and extracting it on your computer?

Exactly, even though that notice still stands there, I can still see all the data without downloading it. I can't say why this option works for some and not for others, maybe it's about internet speed, or it has something to do with the browser. Someone deleted a post with a link, but there is another one in Development & Technical Discussion.

Same thing happened to me, but I managed to view it in the end. My details aren't on there thankfully, but I got emails from Ledger saying my details were included. Not sure what's going on.

Nothing surprises me anymore when it comes to Ledger, because if you're not on the list, why send a notification that you actually are, and in that way confuse you Somehow it seems to me that this circus has no end in sight, who knows what other surprises Ledger is preparing for us.

Yeah. A lot of people from this forum could be exposed if they used the same email address they used to sign up to the forum.

But that e-mail address should only be visible to the admin/s and maybe to the mods if that rule applies when reporting post to moderator (although I think you once mentioned that this is not the case). Maybe you are referring to email addresses that have become publicly available in hacking our forum database back in 2015?

I guess it would be hard to target idividuals because you don't know whether they have 1 dollar in bitcoin or millions.

I’ve already commented in another thread that it’s not the same to rob someone online compared to physical robbery - like you say there’s no point in randomly attacking people without knowing how much they actually own. However, with all the available information, I have no doubt that there will be no attempted physical robberies that will be preceded by fake calls or messages from tax administrations or something similar.

[lovesmayfamilis]

In addition to the fact that many people were scared by the pandemic in 2020, Ledger owners today also fear for their lives due to their data leaks. People start to fear for their families.
 I think those who have accumulated a beautiful amount will be worried. But the scammers themselves will likely spend a lot of effort to find out more accurate information, and this also takes time. Therefore, you should not panic. There is a time for a cold mind and thinking about your next actions.
This once again reminded everyone to take care of their privacy. But everyone also understands that there was the fact that everyone trusted this device, and like when opening a bank card, users entered their exact data. Today news came out that Ledger will not reimburse the costs of users whose data has been opened.

https://decrypt.co/52215/ledger-wont-reimburse-users-after-major-data-hack

[hilariousetc]

But that e-mail address should only be visible to the admin/s and maybe to the mods if that rule applies when reporting post to moderator (although I think you once mentioned that this is not the case). Maybe you are referring to email addresses that have become publicly available in hacking our forum database back in 2015?

I don't think staff could ever see their emails contrary to what the message said (I could be wrong but I don't remember ever seeing them), but yeah I'm referring to the forum database leak. It would be very easy to match those emails to the ledger ones and you would then have someone's full dox. If you knew they were a member that likely had or does have a bit of money then they would probably be easy targets.

In addition to the fact that many people were scared by the pandemic in 2020, Ledger owners today also fear for their lives due to their data leaks. People start to fear for their families.
 I think those who have accumulated a beautiful amount will be worried. But the scammers themselves will likely spend a lot of effort to find out more accurate information, and this also takes time. Therefore, you should not panic. There is a time for a cold mind and thinking about your next actions.
This once again reminded everyone to take care of their privacy. But everyone also understands that there was the fact that everyone trusted this device, and like when opening a bank card, users entered their exact data. Today news came out that Ledger will not reimburse the costs of users whose data has been opened.

https://decrypt.co/52215/ledger-wont-reimburse-users-after-major-data-hack

It's obvious they wouldn't refund people just like most banks won't if you personally were responsible for sending the funds yourself. Doing so would also just open them up to massive fraud as people could just send funds to another address and claim they were hacked and there's no way to verify fake from real there. At the end of the day people are still responsible for the own money even with this hack and people probably shouldn't be falling for phishing attacks like this.

[GrosWesh]

An interesting replay of a discussion relating to this ledger db public leak is available on youtube.

They speak in particular of potential sim swaps and this part starts at 00h35

Andreas Antonopoulos
Taylor monahan
Jameson lopp
Peter McCormack

https://www.youtube.com/watch?v=uKCMx8nqQhY

(If someone got a link to the video antonopoulos is speaking about at 41mn45sec i'd be really interested as i looked for it in vain).

[Saint-loup]

I could see the data and I'm happy that my personal details are not in the documents leaked. Maybe because I bought the Ledger a few years back? My email is there but I already knew that. Also, I don't hold a lot of bitcoin but I would feel uneasy if I knew my full name and address had been leaked.

It probably depends on whether you asked them to store your details or not. The hack happened in June 2020, and they said 1 million email addresses were leaked but only 10k users personal details were included (addresses, phone numbers etc).

Yes but now they admit they were wrong. Personal informations of 272 000 users have been leaked.

The determination of the number of personal details (name, physical address, phone number) that was made in July 2020 was based on the forensic analysis of our third-party security consultancy who have advised there was only evidence of 9,500 impacted persons. These logs only specifically identified just over 9,500 individuals for whom more personal details information was obtained by the attackers. We can now verify from the published database that detailed information (name, postal address, phone number) of about 272.000 users were obtained, which corresponds to our e-commerce database as of June 2020.

https://support.ledger.com/hc/en-us/articles/360015559320-E-commerce-and-Marketing-data-breach-FAQ

[Poker Player]

I could see the data and I'm happy that my personal details are not in the documents leaked. Maybe because I bought the Ledger a few years back? My email is there but I already knew that. Also, I don't hold a lot of bitcoin but I would feel uneasy if I knew my full name and address had been leaked.

It probably depends on whether you asked them to store your details or not. The hack happened in June 2020, and they said 1 million email addresses were leaked but only 10k users personal details were included (addresses, phone numbers etc).

I probably asked them not to. Anyway, I just sent them a ticket through support asking them to remove my email address and any data they have on my from their database.

Does anyone know if they are obliged by law? In some countries there is such a law whereby if I ask private company to remove any data they have on me, they have to remove it.

I know that the leak has happened already but I'm quite pissed of with them. I think ledger live is ****. You can't sign messages with it, for example.

If there are news about ledger that concern me I will know through the forum or other sources.

[LoyceV]

I probably asked them not to. Anyway, I just sent them a ticket through support asking them to remove my email address and any data they have on my from their database.

Does anyone know if they are obliged by law? In some countries there is such a law whereby if I ask private company to remove any data they have on me, they have to remove it.

They're a French company, so it falls under the GDPR (General Data Protection Regulation). However, the implementation may vary per member state. In my country a company could ask to provide evidence you are who you say you are before removing your data, and in practice that often comes down to sending them a copy of your legal ID.
That's usually not something you want to give to a company you don't trust with personal data.

[UserU]

They're a French company, so it falls under the GDPR (General Data Protection Regulation). However, the implementation may vary per member state. In my country a company could ask to provide evidence you are who you say you are before removing your data, and in practice that often comes down to sending them a copy of your legal ID.
That's usually not something you want to give to a company you don't trust with personal data.

That actually exists? And even if you comply, they might not even delete/ trash the documentation you give...

[Csmiami]

It probably depends on whether you asked them to store your details or not. The hack happened in June 2020, and they said 1 million email addresses were leaked but only 10k users personal details were included (addresses, phone numbers etc).

Not to be repetitive on this one; but the hack didn't happen on June; it was detected (and allegedly fixed) in June. We can only speculate as for how long this had been going on...
I'm surprised your data wasn't leaked but you still got the email; that could mean that ledger is playing it safe this time and sending that generic email to every user that ever bought from them, "just to be safe" (but again, speculating)

[notblox1]

Everybody is talking about this Ledger leak on forum, on social media and on youtube
What do you think guys, what would Satoshi Nakamoto do? Would Satoshi buy Ledger wallet and used his real name and address when we know how important privacy was for him?
We are (not) all Satoshi 

[Marvelman]

Everybody is talking about this Ledger leak on forum, on social media and on youtube
What do you think guys, what would Satoshi Nakamoto do? Would Satoshi buy Ledger wallet and used his real name and address when we know how important privacy was for him?
We are (not) all Satoshi 

Yeah, difficult to say. He may really be Satoshi Nakamoto, as far as we know. I don't think anybody has effectively proved that it was either an alias or his real name.