Breach at e-commerce partner Global-e exposes Ledger.com customers' order data

On 5 January 2026 Global-e, the e-commerce company that acts as Merchant of Record for some purchases on Ledger.com, began emailing customers about unauthorised access to order data in its systems; blockchain investigator ZachXBT shared the notification on X, and Ledger confirmed the incident the same day. According to Ledger, the unauthorised party reached a Global-e cloud-based system holding shopper order data from several brands, and Ledger was not the only brand affected. Global-e said it isolated and secured the affected systems after it became aware of the activity.

Global-e said the exposed information may include names, postal addresses, email addresses, phone numbers and order details such as order numbers, products purchased and prices paid. Ledger’s incident FAQ lists the same data and states that no payment information was involved, and that Global-e has no access to recovery phrases, blockchain balances or other digital asset secrets because Ledger devices are self-custodial. Ledger did not say how many of its customers were affected.

Ledger states that its own network, hardware and software were not compromised. The Register reports that a phishing email sent in the name of “E-Global” and addressed to Ledger users, pointing to a supposed device security update, was circulating shortly after the disclosure. This is a separate incident from the 2020 Ledger customer database breach.

What Ledger advises:

• Never share your 24-word recovery phrase; Ledger will never ask for it, send physical items, ask you to scan QR codes or visit websites, or contact you by phone, SMS or WhatsApp.
• Report suspected phishing to phishing@ledger.fr.
• Treat unexpected packages or “replacement” devices with suspicion and check any device you doubt with Ledger’s Genuine Check.
• Clear Sign transactions where possible.