Ledger customer database breach

July 29, 2020LedgerMedium

Who is affected

Names, postal addresses, phone numbers and email addresses of Ledger buyers became public, which identifies them as crypto holders. No device or seed compromise was reported, but the data was later used for phishing, including fake devices sent by mail.

What happened

On 29 July 2020 Ledger disclosed that an unauthorized third party had accessed part of its e-commerce and marketing database, which it uses for order confirmations and promotional emails. Ledger states the access went through an API key, which it has since deactivated. A researcher in Ledger’s bug bounty program reported a possible breach on 14 July 2020; Ledger says the investigation found the flaw had already been exploited on 25 June 2020.

In July Ledger said about one million email addresses were exposed, and that for a subset of about 9,500 customers the first and last name, postal address, phone number and ordered products were exposed as well. Ledger states the breach did not affect payment information, passwords or crypto funds, or the security of its hardware wallets.

On 20 December 2020 the full database was published on RaidForums. According to The Block, the dump held the personal information of more than 270,000 customers and the emails of more than one million, far more than the 9,500 detailed records disclosed in July. In January 2021 Ledger reported a separate Shopify-related incident with about 20,000 new customer records and said about 292,000 customers were affected in total.

What Ledger advises:

Ledger will never ask for your 24-word recovery phrase or PIN; never share it.
Contact Ledger only through its official channels.
Treat emails, texts and messages that refer to the breach as possible phishing.

Sources

Independent reporting and research this entry was checked against.

Change log

Nov 3, 2026Entry rewritten from Ledger's statements and The Block; the earlier unsourced draft is replaced.

Learn more

Guides on protecting yourself against this type of incident (Customer data breach) and the glossary terms that describe it.

Phishing Defense: Protecting Your Hardware Wallet from Social Engineering

Fake websites, spoofed emails, malicious dApps — how phishing attacks target hardware wallet users and how to spot them every time.

Read Guide

Home Invasion and Burglary: Securing Your Crypto Setup

Burglars target crypto holders specifically. How to hide, split, and protect your wallet setup and seed phrase backups at home.

Read Guide

Phishing Attack

A phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.

$5 Wrench Attack

A $5 Wrench Attack is when someone uses physical coercion to force a crypto holder to reveal their private keys or access their funds.

Cite this entry

WalletInsights. “Ledger customer database breach”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/ledger-customer-database-breach-2020/

Corrections and right of reply

Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.

All Ledger incidents

All incidents All Ledger incidents