Loading story…
Ledger.com confirmed that a subset of its customers’ personal data was exposed following a breach at its third-party payment processor, Global-e. The incident was traced to a misconfigured API key on the Ledger website, which allowed unauthorized access to a cloud-based database managed by Global-e. Exposed information included customer names, email addresses, postal addresses, and phone numbers for those who made purchases using Global-e as the Merchant of Record. Both Ledger and Global-e stated that no payment information, account credentials, or crypto wallet recovery phrases were compromised, and their core systems remain secure. The primary risk to affected customers is the potential for targeted phishing attacks using the leaked contact details.
Ledger and Global-e responded by notifying affected individuals and regulators, engaging forensic experts, and implementing containment and remediation measures. Customers were advised to be vigilant against phishing attempts and reminded never to disclose their 24-word recovery phrases. The breach did not impact Ledger’s hardware wallets or payment processing infrastructure, and no financial data was involved. Other brands using Global-e may also have been affected, but Ledger emphasized that the breach was limited to contact and order information, not sensitive crypto or payment credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Soon after the breach became public, cybercriminals began sending phishing messages impersonating Ledger and Global-e to exploit the exposed customer information. Ledger warned users that it would never ask for 24-word recovery phrases, request code scans, or send unsolicited devices.
Following the disclosure, Ledger said affected users would receive direct communication from Global-e, and reports indicated both companies notified impacted customers and relevant regulators. The notifications warned that exposed data included contact and order information.
On January 5, 2026, Ledger disclosed that some customers' personal and order data was exposed through a breach at third-party payment processor Global-e. Ledger said its own systems were not compromised and that no payment data, passwords, or wallet recovery phrases were exposed.
Global-e detected unauthorized access to a cloud-based database tied to Ledger order processing, isolated the affected systems, and brought in independent forensic experts to investigate. Reports said no malware or lateral movement was observed and no threat actor had been identified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcego.theregister.com
Open sourcerescana.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ledger disclosed that customer information was exposed after an incident involving **Global-e**, a third-party e-commerce partner used for order processing. Reporting from *The Register* and *CoinDesk* said the breach affected Ledger customer order data rather than wallet seed phrases or private keys, but still exposed personally identifiable information tied to purchases, raising renewed phishing, social-engineering, and physical-security concerns for hardware wallet owners. Ledger later published support advisories and an FAQ describing the **Global-e incident** and the resulting **e-commerce and marketing data breach**, including guidance on recognizing legitimate Ledger email addresses and avoiding scams. The company linked the event to order-data exposure and framed it separately from the firm’s widely known **2020 e-commerce data breach**, while warning customers to remain alert for fraudulent messages that misuse leaked contact or purchase details.
Jul 12, 2026
Coinbase confirmed an **insider data breach** in which a single contractor improperly accessed customer information affecting approximately **30 customers**. Coinbase said its security team detected the activity, the contractor no longer provides services to the company, impacted users were notified, and **identity theft protection** was offered; Coinbase also reported the incident to relevant regulators. The disclosure followed brief Telegram posts by threat actors showing screenshots of an internal **Coinbase support interface** that appeared to expose access to sensitive customer data, including **names, email addresses, phone numbers, dates of birth, and KYC information** (and, per the leaked interface screenshots, potentially wallet balances and transaction details). Reporting indicated the incident is **separate from the previously disclosed TaskUs-related insider breach**, and it remains unclear whether the group that posted the screenshots (reported as **“Scattered Lapsus Hunters”**) conducted the access or merely obtained and shared the data; the incident highlights ongoing targeting of **BPO/contractor ecosystems** due to their privileged access to internal tools and customer records.
Jun 29, 2026
Ernst & Young (EY) disclosed a data breach after attackers gained unauthorized access to a third-party IT support and ticketing platform used by EY personnel supporting tax-related client work. EY said the intruders accessed the system between **March 28 and April 12, 2026**, downloaded multiple documents, and exposed personal and financial information used for tax preparation, including data tied to some individuals’ investment holdings with EY institutional clients. The firm detected anomalous activity on **April 23**, launched an investigation with external cybersecurity experts, secured affected systems, and notified federal law enforcement. EY has not disclosed the identity of the third-party vendor, the number of affected individuals, the attack method, or any attribution to a threat actor. The company said it has not found evidence that the stolen information has been misused or that specific individuals were deliberately targeted, and began notifying affected people on **July 13**. EY also filed breach notifications with the California Attorney General and is offering eligible individuals **24 months** of Experian identity monitoring and restoration services.
Jul 27, 2026