WARNING! A hacker leaked data on 300,000 Ledger users to the network
A hacker leaked data on 300,000 Ledger users to the network. Companies face class-action lawsuits. Community Accuses Ledger Hardware Wallet Developers For Insufficient Personal Data Security
As a reminder, in June 2020, a hacker hacked into the Ledger database. And recently, the personal of all users were published on the network. And now the victims are threatening the company with a class action lawsuit.
At first, as the representatives of Ledger announced in the summer, 9,500 owners of hardware wallets for storing cryptocurrency were compromised. However, the real number of victims, judging by the data published on hacker websites, is about 300 thousand people.
There is a heated discussion of this issue on Twitter. Alon Gala, a cybersecurity officer at Hudson Rock, said the hacker who attacked Ledger in June had leaked the entire database.
ALERT: Threat actor just dumped @Ledger's database which have been circling around for the past few months.— Alon Gal (Under the Breach) (@UnderTheBreach) December 20, 2020
The database contains information such as Emails, Physical Addresses, Phone numbers and more information on 272,000 Ledger buyers and Emails of 1,000,000 additional users. pic.twitter.com/Sv9cQwhuNy
As a result, the following appeared on the network:
- 1,075,382 email newsletter subscribers;
- 272 853 email addresses, residence addresses and phone numbers of customers of wallets.
The leak, according to the specialist, poses a danger to everyone on the list. Large amounts of money are usually stored with Ledger, and now their owners can be pursued by attackers both online and offline.
In their account, Ledger employees confirmed that, judging by the initial data, the list published on the Internet really concerns the data stolen in June.
Today we were alerted to the dump of the contents of a Ledger customer database on Raidforum. We are still confirming, but early signs tell us that this indeed could be the contents of our e-commerce database from June, 2020.— Ledger (@Ledger) December 20, 2020
Moreover, as it became known, the database had already spread across hacker forums, and attackers began to assail the users of the hardware wallet:
- inundated with spam;
- send emails with a request to download new software from dubious sources;
- on behalf of Ledger, they are asked to provide a passphrase or transfer bitcoins to another address.
Since June, the company has been actively working with law enforcement agencies to prosecute fraudsters. In total, over 170 phishing resources have been blocked since the hack.
Now the level of discontent among users of the wallet has increased so much that some on Twitter are writing about their readiness to support a class action lawsuit against Ledger.
The reason is simple. Due to the hack, users fear for their bitcoins and even their lives. There are rumors in the community that there is a high likelihood of being kidnapped, as happened to Singaporean entrepreneur Mark Cheng in January.
People are confused and just don't know what to do. Many cybersecurity professionals offer their help to minimize risks and maximize security.
For example, today at 12 PM PST / 20 UTC, a broadcast on YouTube from a well-known popularizer of blockchain technologies with the nickname Aantonop starts. And even if your information hasn't been compromised, you can see how to make it even more secure.
More about the incident
The database vulnerability was discovered by a Bug Bounty Ledger researcher on July 14. The Ledger developers reacted quickly and eliminated it. However, it turned out that on June 25, during the hack, personal information, order lists and e-mails of hardware wallet customers were stolen.
The database was accessed using an API key. Payment information, passwords and user funds were not affected. Despite Ledger's claim that the security of bitcoins is safe, it is now clear that the situation is much worse than initially thought.
Following the investigation, the company filed a report with CNIL on July 17, and four days later used Orange Cyberdefense's help to assess the damage from data breaches. However, no evidence was found that the stolen data was being sold on the Internet. As well as phishing attacks on victims.
A bit of history
As a reminder, this is not the first time a Ledger cyberattack has occurred. The company has positioned the hardware wallet as a super secured wallet that cannot be hacked. In 2018, a 15-year-old teenager posted on a blog how he hacked a Ledger Nano S model.
True, it was a used wallet that can be bought on eBay. As you can see from the video, with a certain modification for the hardware, a new wallet address with access passwords known to the cracker is easily generated. The data is then copied to another hardware wallet, private keys are restored, and the cryptocurrency is withdrawn.
Interestingly, before this hack, Ledger representatives stated that users can buy used wallets without fear of the safety of funds.
After the publication of the data on the young hacker's blog, Ledger representatives fixed the bug by upgrading the firmware. Nevertheless, the users of the wallet still have an unpleasant aftertaste.
The company positions the wallet as 100% secure. Each set with a hardware wallet for cryptocurrency has a special flyer with an indication of this.
As it turned out, this is not the case. And against the backdrop of this week's events, it is clear why the community of victims is on the verge of filing a lawsuit ...