Loading story…
Ledger disclosed that customer information was exposed after an incident involving Global-e, a third-party e-commerce partner used for order processing. Reporting from The Register and CoinDesk said the breach affected Ledger customer order data rather than wallet seed phrases or private keys, but still exposed personally identifiable information tied to purchases, raising renewed phishing, social-engineering, and physical-security concerns for hardware wallet owners.
Ledger later published support advisories and an FAQ describing the Global-e incident and the resulting e-commerce and marketing data breach, including guidance on recognizing legitimate Ledger email addresses and avoiding scams. The company linked the event to order-data exposure and framed it separately from the firm’s widely known 2020 e-commerce data breach, while warning customers to remain alert for fraudulent messages that misuse leaked contact or purchase details.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Ledger published an FAQ covering the e-commerce and marketing data breach, providing customers with additional guidance and answers about the incident. The FAQ appears to consolidate response information and support resources.
Ledger released a dedicated support article about the January 2026 Global-e incident affecting order data, documenting the incident for customers. The notice served as an official reference page for the breach and its scope.
Ledger published a support article listing legitimate Ledger email addresses to help customers distinguish authentic communications from phishing attempts following the breach-related concerns. This was part of its customer guidance and response materials.
Ledger confirmed that customer data had been accessed or lifted as part of the Global-e-related incident, providing public acknowledgment of the breach. Media coverage on January 6 reported Ledger's confirmation and the involvement of the third-party e-commerce provider.
In early January 2026, Ledger disclosed that a security incident involving its e-commerce partner Global-e led to unauthorized access to some Ledger customer order data. Reporting described the exposure as a new customer data breach affecting Ledger through the third-party partner.
Ledger said it suffered an e-commerce and marketing database breach in July 2020 that exposed customer contact and order-related information. The company published a leadership statement addressing the incident and its impact on affected users.
6 references tracked. Mallory keeps watching after this page renders.
support.ledger.com
Open sourcesupport.ledger.com
Open sourcesupport.ledger.com
Open sourcetheregister.com
Open sourcecoindesk.com
Open sourceledger.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ledger.com confirmed that a subset of its customers’ personal data was exposed following a breach at its third-party payment processor, Global-e. The incident was traced to a misconfigured API key on the Ledger website, which allowed unauthorized access to a cloud-based database managed by Global-e. Exposed information included customer names, email addresses, postal addresses, and phone numbers for those who made purchases using Global-e as the Merchant of Record. Both Ledger and Global-e stated that no payment information, account credentials, or crypto wallet recovery phrases were compromised, and their core systems remain secure. The primary risk to affected customers is the potential for targeted phishing attacks using the leaked contact details. Ledger and Global-e responded by notifying affected individuals and regulators, engaging forensic experts, and implementing containment and remediation measures. Customers were advised to be vigilant against phishing attempts and reminded never to disclose their 24-word recovery phrases. The breach did not impact Ledger’s hardware wallets or payment processing infrastructure, and no financial data was involved. Other brands using Global-e may also have been affected, but Ledger emphasized that the breach was limited to contact and order information, not sensitive crypto or payment credentials.
Jun 29, 2026
Lidl disclosed a customer data breach affecting users of its online shop in **Germany, Belgium, and the Netherlands** after attackers compromised an external IT service provider and briefly accessed a separately stored file. The retailer said its online shop systems were **not** breached directly, but the exposed data includes customer names, telephone numbers, email addresses, dates of birth, salutations, and customer numbers. Lidl said it cannot yet rule out exposure of passwords, billing and delivery addresses, bank details, or other payment information, although it has not reported concrete evidence of misuse so far. The service provider has restored system security, filed a police report, and engaged forensic experts, while Lidl notified the relevant data protection authority, including the Dutch regulator, and warned affected customers to watch for phishing attempts and identity fraud.
Jul 18, 2026
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner **CEVA Logistics**. The company said attackers had access to CEVA servers between **July 29 and August 1, 2026**, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers. Valve said the breach was limited to fulfillment data held by CEVA and did **not** expose Steam account credentials, payment card information, or **Steam Guard** codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Aug 10, 2026