Leaked hundreds of thousands of user information, hardware wallet Ledger encounters a crisis of trust

Original title: "Hundreds of thousands of user information leaked, hardware wallet Ledger encounters a crisis of trust"

Original source: Babbitt

Vote with your wallet.

Ledger has lost the trust of users.

The customer information leaked in July, which was already available to those willing to pay, is now free.

Last night, someone posted the list and information of Ledger's 272,853 customers and 1,075,382 email users on raidforums, which frustrated some forum users.

In July 2020, while participating in the Ledger bug bounty program, a researcher discovered a potential attack vector, which was later discovered has been exploited. Later, Ledger announced that its website had been compromised:

"An unauthorized third party accessed a portion of our e-commerce and marketplace database via an API key

According to reports, the leaked data information has been sold for nearly six figures, which proves the value of these personal information, no matter who In paying for this information, they are all about profiting from it.

Since this information is now freely accessible, users have reported an increase in phishing attempts. And over the next few months, we expect this behavior to continue to grow, so it wouldn't be surprising to hear of people being physically attacked as a result of this type of data breach.

In a worst-case scenario, compromised personal information could lead to physical attack or burglary.

Originally, Ledger told us that the number of users whose data had been made public was 9,500, including their names, postal addresses, and phone numbers. Now, we find that number is actually closer to 227,000.

Did Ledger deliberately conceal the seriousness of the incident?

We interviewed a Ledger representative who provided the following statement:

We are still Investigating this ongoing issue, the leak may have been Ledger's e-commerce database, which was compromised back in June 2020. Scammers may use this database to conduct phishing attacks through email and SMS campaigns.

Our customer support team has been working hard to notify users via Twitter, answer questions, and also report any tweets that contain links to databases text and Reddit post. We urge all users not to share their seed phrases, and remember that the team does not ask users for private information.

Since the data breach was discovered in June 2020, we have conducted a forensic review in collaboration with an external security organization. This review confirmed that only 9,500 individuals were affected, and Ledger support staff personally contacted all affected users. Since the phishing attacks began, we anticipate more leaks and continue to notify all users via Twitter and email.

We are doing everything we can to stop these attacks and prevent this from happening in the future. Ledger has a number of measures in place to protect our users from falling victim to phishing attacks. We have set up a web page to share the anatomy of a phishing attack so users can avoid falling for it and report any new attacks:

https://www.ledger.com/phishing-campaigns-status

We deeply regret this situation and our team is working hard to stop the scammers and restore the community's trust in us. We have been open and transparent about this issue from the outset and will continue to respond to any new developments as information becomes available. We are continuing to analyze this data and will continue to provide updates.

The problem of third-party storage of user information

This situation shows the problem of relying on third parties to store our information.

With the development of Web3.0, the problems of Web2.0 become more and more obvious. Enforced compliance by offline companies slows our progress and puts our information at risk.

Despite the known risks of centralized storage, we are forced to entrust our data to these companies. Companies like Ledger are still torn between the old world and the new world, unable or unwilling to implement techniques like zero-knowledge proofs to secure their databases.

It's not just the criminal world that is keen to see the information, there have been cases in Europe where some officials bought the data of Swiss bank customers to help them Conduct tax fraud investigations.

The strict framework of the GDPR has been obliterated by this data breach. Customers requesting data deletion appear to have been ignored, or even tricked.

A Ledger customer told us this:

In May 2020, I gave They sent an email asking them to remove any data about me from multiple orders. I referenced the GDPR in the email and they replied, "Thanks for contacting us, we will get it done as soon as possible."

With Following this information leak, I cross-checked and found out that a lot of my data was leaked (email, address, phone...)

Ledger It should ensure that personal data is automatically deleted after a set time.

Is Ledger incompetent, ignoring these requirements, or is it not being honest enough?

These are not important now, and nothing that happens can be changed.

There is no cure for data breaches, the only solution is prevention.

Original link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia