Attacks have started raining down on some Ledger users after a major data breach left them exposed
In response to these attacks, Ledger users have taken to social media to vent, with the company reportedly offering little help. Judging from their complaints, it appears that the inevitable attacks have already begun and the number of victims is slowly rising.
Ledger has been facing a lot of criticism since the June incident that resulted in users’ confidential data being leaked. The company confirmed that its e-commerce marketing database had been breached on 25 June and they didn’t immediately discover the issue. It took almost three weeks for the company to realise the data breach after a researcher pointed it out on 14 July.
Emails of about one million users were leaked. Some clients had additional information, such as phone numbers and residential addresses, that were also leaked.
Several users have complained they are receiving phishing emails with a few others reporting they have lost funds. Users that had their contact information leaked have also reported getting malicious texts on their phones. Even worse, reports have emerged that the perpetrators dumped the data on Raidforums –a database sharing & marketplace forum.
“Today we were alerted to the dump of the contents of a Ledger customer database on Raidforum. We are still confirming, but early signs tell us that this indeed could be the contents of our e-commerce database from June, 2020,” the Ledger team tweeted.
Scammers have taken advantage and racked up the data that they are now using to send out attacks.
Twitter user Ivan on Tech posted, “SCAMMERS ARE GOING WILD. Sending fake emails pretending to be Ledger apologizing for the data leak and phishing you to install ‘latest version’. BEWARE!!”
The wallet manufacturer stated it had contacted French law enforcement authorities to intervene. Ledger also said it was working to contain and deal with the attack. It has, additionally, put up a notice on its homepage warning users about the phishing campaigns.
Beyond phishing, other users have reported SIM swapping attacks. There is also a possibility that ransom attacks are looming as physical addresses were also leaked. So far, no reimbursements have been made, and based on the remarks of the Ledger CEO, refunds are out of the equation.
Speaking to media outlet Decrypt, the CEO Pascal Gauthier said, “When you have a data breach of this magnitude for such a small company, we won’t reimburse for a million users, all the devices, that’s just not possible.”