Hardware wallet maker Ledger said a breach of its marketing and e-commerce database exposed roughly one million customer email addresses, while a smaller subset of users had more detailed personal information compromised. The company stressed that the incident did not affect customer funds, payment information, passwords, or the security of its hardware wallets and Ledger Live.
In a public statement, the French crypto security firm said the exposed records also included contact and order-related information. For around 9,500 customers, the leaked data reportedly included first and last names, postal addresses, and phone numbers. According to Ledger, the attack targeted systems used for commercial communications rather than the infrastructure that protects users’ crypto assets.
What Happened
Ledger said the breach involved its marketing and e-commerce database, which is used to send order confirmations and promotional emails. An unauthorized third party gained access through an API key that has since been deactivated. The company said the vulnerability has now been patched.
The timeline outlined by Ledger is significant. A security researcher participating in the company’s bug bounty program reported the issue on July 14. During its response, Ledger discovered that the weakness had already been exploited on June 25, weeks before the report was filed. That means the company was dealing not just with a theoretical vulnerability, but with an incident in which unauthorized access had already taken place.
While breaches involving crypto firms often trigger concerns about theft of digital assets, Ledger emphasized that this case was different in scope. The company said there was no link between the exposed database and the security architecture of its hardware wallets. In its statement, Ledger said users’ crypto assets remained safe and had “never been in peril.”
What Data Was Exposed
The company’s disclosure makes a distinction between the broader and narrower impact groups. The larger affected population consisted of about one million email addresses. That alone is a serious issue, especially in the crypto industry, where bad actors frequently use leaked contact data to launch phishing campaigns or social engineering attacks.
For a subset of 9,500 customers, the exposure was more severe. In those cases, the leaked information included names, mailing addresses, and phone numbers. Combined with order information, such data can increase the risk of targeted fraud attempts. Even if private keys, seed phrases, and payment credentials were untouched, personal data leaks can still create meaningful downstream risks for users.
Ledger was explicit about what was not compromised. The company said that payment details, passwords, and user funds were not affected. It also stated that the breach had no impact on Ledger Live or on the security of the company’s hardware wallet products.
Company Response
Ledger described the incident as deeply regrettable and said it had taken formal and technical steps in response. The company reported the breach to France’s data protection authority, CNIL, on July 17. It also said that four days later it partnered with Orange Cyberdefense to assess the potential damage and identify whether any additional data exposure had occurred.
That response suggests Ledger moved on both regulatory and forensic fronts: first by notifying the relevant privacy authority, and second by bringing in external cybersecurity expertise to evaluate the breach. For companies handling customer records in the crypto sector, those measures are increasingly expected after a material data security event.
Ledger also said it was monitoring for signs that the stolen data was being offered for sale online. At the time of its disclosure, the company said it had found no evidence that the data had been sold on the internet. Even so, the absence of immediate evidence does not remove the broader security implications of a leak involving customer contact data.
Why the Incident Matters
The breach is notable because Ledger is best known as a security-focused company whose products are designed to help users store digital assets offline. Although the incident did not compromise wallets or funds, it highlights a different layer of risk in the crypto ecosystem: the exposure of customer data through business and commercial systems rather than wallet infrastructure itself.
In practice, leaked email addresses and personal details can be used to craft convincing phishing emails, SMS scams, and impersonation attempts. Attackers may reference order history or brand familiarity to pressure users into revealing recovery phrases or installing malicious software. That is why a breach that leaves funds technically untouched can still carry serious consequences for affected customers.
Ledger acknowledged this risk by warning users to remain alert to phishing attempts from malicious scammers. That warning is especially relevant for crypto holders, who are frequent targets of highly personalized fraud campaigns following publicized data incidents.
Broader Takeaway for Users
The Ledger incident underscores an important point for the digital asset industry: operational security extends beyond custody technology. Even when wallet architecture remains uncompromised, weaknesses in marketing tools, e-commerce platforms, or customer management systems can expose users to secondary attacks.
For customers, the immediate lesson is caution. Any unexpected message claiming to come from Ledger or another crypto company should be scrutinized carefully, particularly if it asks for credentials, wallet recovery phrases, or urgent account action. Firms may be able to protect private keys and on-chain assets, but once personal contact data is exposed, the risk often shifts toward deception and social engineering.
Based on Ledger’s disclosure, this was a breach of customer data, not of wallet security. Still, the exposure of about one million email addresses and more detailed personal records for 9,500 users makes the incident a significant reminder that crypto security depends on the entire operational stack, not just the device that stores the keys.