One more Ledger leak?

[dkbit98]

Ledger company and their partners Shopify are going to be busy in court for some time because class action lawsuit is filled against them by law firm Roche Freedman on April 6 in San Francisco.
The same law firm is known from before when they had class actions against Binance exchange and Tron, and we are finally going to see who is really responsible for Ledger database leaks.
No comment from Ledger so far, and you can read all the lawsuit details in this 43 pages long scribd document:
https://www.scribd.com/document/502073705/Ledger-Shopify-Complaint

[1715088470]

1715088470

[1715088470]

1715088470

[1715088470]

1715088470

[1715088470]

1715088470

[1715088470]

1715088470

[FatFork]

Ledger company and their partners Shopify are going to be busy in court for some time because class action lawsuit is filled against them by law firm Roche Freedman on April 6 in San Francisco.
<cut>

As stated by The Block in its post:

The degree to which Ledger and Shopify communicated with customers about the ongoing breach and their respective responsibility for phishing victims that resulted are likely to be critical points of the case.

That's exactly what I'm thinking.

[Pmalek]

As stated by The Block in its post:

The degree to which Ledger and Shopify communicated with customers about the ongoing breach and their respective responsibility for phishing victims that resulted are likely to be critical points of the case.

The prosecution will have to prove that Ledger was aware of the extent and size of the breach from the very beginning beyond a reasonable doubt. Unless someone testifies and confirms this or there are documents that can prove that Ledger knew the size of the breach, I think they might get away with it and claim we simply didn't know. When we found out, we informed the general public. It's certainly going to be an interesting case to follow. 

[HCP]

It's certainly going to be an interesting case to follow. 

Yeah... unfortunately, there will probably also be the requirement to prove "willful negligence" on the part of Ledger and Shopify with regards to their security practices and whether the hack was due to them being negligent, or just the "hackers" being clever/abusing 0day vulnerabilities etc... will be interesting to see how those "Liability" disclaimers in the Terms of Service etc hold up in court.

I'm also a little confused as I've seen somewhat conflicting information that this "hack" was actually an inside job conducted by one or more Shopify employees who abused their position to access/copy the data and then sell it on the black market.

Which seems somewhat at odds with the reports of the "bug bounty" that some guy found a "misconfigured" API key that enabled external access etc.

[Pmalek]

I'm also a little confused as I've seen somewhat conflicting information that this "hack" was actually an inside job conducted by one or more Shopify employees who abused their position to access/copy the data and then sell it on the black market.

Which seems somewhat at odds with the reports of the "bug bounty" that some guy found a "misconfigured" API key that enabled external access etc.

I always thought that the Spotify breach was a separate incident to what happened to Ledger. Maybe because the public was first made aware that Ledger's database got hacked/leeked, and only after that we discover that it was due to Shopify's personnel that the database was stolen in the first place (allegedly).

In this report, Ledger claims they were made aware that there was a breech through a third-party API key in July 2020. Back then, they were still suspecting that complete details of only 9.500 customers were leeked + 1 million emails. They went public and informed people what happened, or more precisely, what they though had happened.

The article goes on to mention that it wasn't until December 2020 that they found out that the breech was much bigger. Shopify informed them that records of Ledger users were among 200 other merchants that were affected by those rogues Shopify employees.

If Ledger manages to prove they took appropriate measures between July-December 2020 based on the data they had and that they weren't lying, the repercussions might not be that severe. They will still have to answer how it was possible that they didn't discover the malicious API key that exported the data and why their customer's personal information wasn't encrypted or deleted. They might claim that the responsibility to store client information was Shopify's duty, not Ledger's. The fact they had a bug bounty might be seen as a mitigating measure, and that they showed an interest in strengthening their systems. We will have to see whether or not that holds up in court.     

[o_e_l_e_o]

I always thought that the Spotify breach was a separate incident to what happened to Ledger.

This was my understanding as well. I believe that there was a significant overlap between the two databases which were stolen - Shopify's one and Ledger's own internal one - but that they were not identical and they were accessed by two different individual at different times.

They might claim that the responsibility to store client information was Shopify's duty, not Ledger's.

Correct me if I'm wrong, but if we are saying that there were two separate hacks of two different databases, then doesn't that confirm that Ledger were in fact also storing client information? The fact that they said things like "We immediately patched the vulnerability" at the time means that at least one of the hacks was on their own servers and not that of a third party.

[Pmalek]

We could be wrong thinking there were 2 different leeks. Both Ledger and Shopify mention that data was stolen using an API key.

I think this is the timeline of the entire incident:

1. April - June: Members of Shopify support team steal data of over 200 merchants.
2. July 14: Someone informs Ledger Donjon security team that they have suffered a breach.
3. Ledger claims they "immediately fixed the data breach". I am not sure what this means and what was fixed.
4. After that, they conducted an investigation and discovered that the breach happened through an API key.
5. July 29: Ledger informs the community of the breach and sends a report to law enforcement.
6. September: Shopify releases a statement that mentions that data of over 200 merchants were stolen.       
7. December: Spotify informs Ledger that among the records that were stolen by their employees, there were also private records of Ledger users. 

If this is the correct timeline, how did the person who informed Ledger in the bug bounty know about the breach? I remember reading that no data was public at that time (again allegedly). Did the person inspect the faulty API key?

Ledger says:
 

We immediately fixed the data breach and launched internal investigations. We discovered a malicious attacker had gained unauthorized access to our e-commerce and marketing database via a third party’s API key.

https://www.ledger.com/blog/update-efforts-to-protect-your-data-and-prosecute-the-scammers

These sentences make it sound like Ledger fixed the breach first, then they launched an investigation. It was during the investigation that they discovered the API key. Again, how did they fix the breach before the investigation if the investigation lead to the discovery of the API key?

[HCP]

I always thought that the Spotify breach was a separate incident to what happened to Ledger.

Ahhhh ok... yeah, an article I was reading a couple of days ago regarding the lawsuit seemed to be implying that the 2 were the same thing... it may have just been the article was poorly written or that I completely misunderstood what they were saying (most likely the later! )

[o_e_l_e_o]

-snip-

On reading this page again - https://www.ledger.com/blog/update-efforts-to-protect-your-data-and-prosecute-the-scammers - it does sound to me like these are two separate incidents.

While the database is 93% similar to those exposed in the previous attack

They wouldn't use the phrase "previous attack" if there had only been one breach, and as I said above, the fact that the databases are not identical means there were two different attacks.

Further down the page, they also highlight their response to the "data breach discovered on July 14th", and separately highlight their response to the "Shopify data breach". It seems to be coincidence that the Ledger hack and the Shopify hack occurred roughly around the same time, explaining why the databases were similar but not identical, but they were indeed two entirely separate incidents.

Did they ever release any details about their new project which was going to replace 12/24 word seed phrases or something along those lines?

[Pmalek]

Did they ever release any details about their new project which was going to replace 12/24 word seed phrases or something along those lines?

The only thing I know is that one of their co-founders confirmed on reddit that users will have a way to insure their cryptocurrencies against theft. It's not going to be based on any software. It will be some sort of hardware solution.

All I can tell for the time being is that it will be an hardware based social recovery solution which will of course be optional 

https://www.reddit.com/r/ledgerwallet/comments/kwhyky/ledger_security_notice/

[o_e_l_e_o]

"Hardware based social recovery solution" sounds awful. There are two potential ways I am reading this. Both are bad.

First is that they will make your hardware wallet reveal your seed phrase if you can prove to them you are the real owner. This would require KYC, it would require each hardware wallet to have a unique identifier tied to your real identity, and it would mean you can have your seed phrase stolen via social engineering.

The other is that they will recover your seed phrase for you if you prove your identity and prove ownership of your hardware device. This has all the same issues as above in addition to the huge risk of Ledger storing a copy of your seed phrase (and as we've seen, Ledger databases aren't exactly secure).

Perhaps they have come up with something truly groundbreaking, but a "social recovery solution" sounds like it will create more problems than it solves and be overly complex compared to what we currently have. I mean, how difficult is it to just write down a handful of words and keep them safe?

[dkbit98]

Perhaps they have come up with something truly groundbreaking, but a "social recovery solution" sounds like it will create more problems than it solves and be overly complex compared to what we currently have. I mean, how difficult is it to just write down a handful of words and keep them safe?

This social recovery solution will probably be one more ledger attempt to invent warm water again, but they will not release anything if they lose this class action lawsuit.

What is concerning is the fact that you can't find almost any discussion or information about upcoming lawsuit on their reddit page, and I don't know if moderators are deleting posts or not,
but literally every single crypto news reported about this and people want blood.
Ledger Twitter account is also silent about this but I see they have time to tweet about NFT  

#NFTart can be pretty awesome.
#NFTCommunity, share your favorites below and tag the #NFTartist.

https://twitter.com/Ledger/status/1381608198126366731

[Pmalek]

I think those lawsuits and court proceedings will take a few years before a decision is made or we might even see a settlement between the counterparties.  If there isn't a settlement, don't forget that both sides usually appeal, then that leads to new proceedings, etc., etc.

The fact they aren't talking about it on their social media channels is understandable from their point of view. No one would want to advertise how big of a schmuck he is. Try creating a new discussion on their reddit page to see whether or not they will remove it.   

[dkbit98]

I think those lawsuits and court proceedings will take a few years before a decision is made

Bro get real please, this is not Balkan or Wild West and courts actually work like they should most of the time

The fact they aren't talking about it on their social media channels is understandable from their point of view. No one would want to advertise how big of a schmuck he is. Try creating a new discussion on their reddit page to see whether or not they will remove it.  

I didn't say they should start any topics themselves, but it's strange that nobody is talking about that, maybe because they banned everyone on reddit who complained before.
You can get banned even if you ask ledger co-founder why is he spending so much time as reddit moderator. True story.

[Pmalek]

Bro get real please, this is not Balkan or Wild West and courts actually work like they should most of the time

I know it's not the Wild Balkans but it's still a lengthy process that can take several years. I am not saying it will, but there is that possibility. Ledger is not the only party being sued for something.

Doing a search for "how long does a lawsuit take" delivers results mostly for personal injury claims (for some reason) and those take years as well.
The first result says:

How Long Does a Personal Injury Claim or Lawsuit Take? Most cases take anywhere from a year to five years after a lawyer is hired to conclude.

https://macgillivraylaw.com/how-long-does-a-personal-injury-claim-or-lawsuit-take

A different source shows this:
Average Case, 2-5 years
Personal Injury -2-3 years
Medical Malpractice, 2-3 years
Patent Issues, 1-5 years
https://glofin.com/how-long-will-lawsuit-take/

[dkbit98]

I have seen people received fake ledger devices to steal treir coins, some of them got personal threats, but don't be surprised if you start to receive PulseChain and HexCoin paper promo materials in your mailbox,
in case your home address was leaked in one of previous ledger leaks that includes name, address, email and phone number.
They are now using this database with over 270k addresses that is publicly available and they are sending this crap to everyone they want