Ledger Users Targeted in Phishing Scam Following Global-e Data Breach

The suspected scammers are utilizing leaked order knowledge to personalize messages, making the emails a lot tougher to dismiss.

Cybercriminals have reportedly launched a focused phishing marketing campaign utilizing a pretend merger between cryptocurrency {hardware} pockets producers Ledger and Trezor.

This follows a current knowledge leak at Ledger’s third-party e-commerce accomplice, International-e.

Particulars of the Phishing Rip-off

On January 5, Ledger disclosed to its prospects by way of electronic mail that International-e had suffered an information breach, exposing buyer info, together with names, electronic mail addresses, telephone numbers, and order particulars. Shortly after the incident was made public, affected customers started receiving phishing emails falsely claiming that the 2 firms had merged. Screenshots of the pretend communications have since been shared on X.

“We’re happy to announce that after months of strategic discussions, Ledger and Trezor have finalized a merger settlement. This landmark partnership unites two trade leaders with a shared imaginative and prescient of offering the very best customary of safety for digital asset administration,” read the message.

The e-mail additional acknowledged that the choice would permit the 2 companies to speed up innovation, increase their product choices, and proceed their dedication to defending purchasers’ belongings. Recipients had been additionally instructed to “migrate” their wallets by coming into their 24-word restoration phrases on a pretend web site designed to imitate official branding.

In response to the assault, International-e has reportedly launched an inner investigation into the hack and is working with cybersecurity consultants to evaluate the scope of the incident. In the meantime, the corporate has not disclosed the precise variety of affected customers however confirmed that the breach was restricted to contact and order info.

Ledger has additionally reportedly notified related knowledge safety authorities and is cooperating with legislation enforcement businesses.

A Historical past of Knowledge Breaches

This episode shouldn’t be the primary time Ledger has been concerned in such a scandal. In 2020, attackers additionally accessed its e-commerce and advertising databases, exposing the non-public info of lots of of hundreds of customers.

You might also like:

The disclosed knowledge included electronic mail addresses, names, telephone numbers, and bodily addresses, with affected customers later reporting receiving phishing emails and threats. On the time, the pockets producer confronted public criticism for its delayed disclosure and insufficient safeguards, which resulted in a proper lawsuit being filed towards it and Shopify.

The corporate later confirmed {that a} rogue Shopify worker was accountable for leaking the non-public particulars of roughly 20,000 prospects. This was adopted by a separate assault later that 12 months, by which the info of about 292,000 prospects was revealed on-line.

Extra lately, the agency suffered one other safety incident, ensuing within the theft of roughly $600,000 in cryptocurrency after a pockets drainer was inserted right into a library utilized by a number of decentralized purposes to hook up with their units.