The Ledger 2020 Data Breach Explained

Video transcript

Ledger's 2020 breach took no crypto. It took a list of customers and many home addresses, through an API key.

In June 2020, an outsider used an API key to reach part of Ledger's e-commerce database. A bounty researcher flagged it on July 14. Ledger disclosed on July 29, and in December a customer database leaked online.

Ledger first counted about a million emails and 9,500 detailed records. The December dump held 272,853 buyer records with names and mailing addresses.

Why the gap? Ledger's CEO said the detailed data was not available in the logs it could analyze, so the damage was hard to size.

The breach touched no funds, Ledger says. Customers took the harm: phishing, a fake Ledger Live built to steal recovery phrases, and fear of attackers at the door. Ledger said it took down over 170 phishing sites.

Scope every key to its job, and log reads, not just writes. Treat customer lists as sensitive, plan the aftermath, and keep a bug bounty. That is how Ledger found out.

Guardian's API Pentest starts from a premise: API keys are long-lived and trusted on every call. It tests scoping, authorization, forgotten endpoints and abuse limits, at every privilege level.

Read the full article for the timeline and sources, or talk to Guardian about testing what your keys can reach.

Ledger's 2020 breach took no crypto. It took a list of Ledger customers, and many of their home addresses.

The way in was an API key. Here is what happened, how it worked, and what an API pentest checks.

What Happened

On July 14, 2020, a researcher in Ledger's bug bounty program reported "a potential data breach on the Ledger website." Ledger says it fixed the issue immediately.

Its internal investigation then found the flaw had been exploited on June 25, 2020, by an unauthorized third party.

On July 29, Ledger disclosed the breach. The outsider had reached "a portion of our e-commerce and marketing database through an API Key."

Ledger's July count:

• About 1 million customer email addresses.
• A subset of 9,500 customers whose name, postal address, phone number or ordered products were also exposed.

Ledger says payment data, passwords and crypto funds were safe. It says the breach had no link to its hardware wallets or Ledger Live.

How the Attack Worked

Ledger's account of the mechanism is short. An API key gave access to part of the database, and the key "has been deactivated and is no longer accessible."

Ledger's notice does not say whose key it was, where it was exposed, or what else it could reach.

Three facts from Ledger's own posts still stand out:

• One key was enough to read about a million customer emails.
• An outsider found it. A bounty researcher reported it 19 days after the June 25 access.
• The logs undercounted. Ledger's CEO later said the detailed data that leaked was "not available in the logs" it could analyze.

That helps explain why the July and December numbers differ. When logs miss what a key read, the damage is hard to size.

Timeline and Impact

What leaked in December

Ledger's CEO said the dump was likely the e-commerce database from June. Threatpost, citing Cyble researchers via BleepingComputer, reported two files:

• 1,075,382 newsletter subscriber email addresses.
• 272,853 buyer records with names and mailing addresses.

Cointelegraph reported the same counts. It said the order records also held phone numbers.

In July, Ledger's log review had identified 9,532 customers with detailed data exposed, its CEO said. The dump held far more.

What followed

The breach itself touched no funds, Ledger says. The harm landed on customers.

• Phishing: Ledger's CEO said "many of you have been targeted by e-mail and SMS phishing campaigns."
• Fake software: Threatpost, citing Proofpoint, described emails pushing a backdoored Ledger Live to steal recovery phrases.
• Physical fear: One customer asked on Twitter what was stopping attackers "knocking on our doors," Cointelegraph reported.
• Takedowns: Ledger said on Twitter it had taken down more than 170 phishing websites since the breach, per Cointelegraph.

Ledger's CEO said the company would not refund customers. He said nothing in the leaked data links a customer to the funds in their wallet.

What It Shows

An API key is a credential like any other, but it rarely gets the same review. Five points from this breach:

1. Scope every key to its job. A key built for one function should not read a whole customer database.
2. Log reads, not just writes. Ledger could size its breach only from logs that missed the detailed records.
3. Treat customer lists as sensitive. For a wallet maker, a buyer list is a list of crypto holders with addresses.
4. Plan the aftermath. Tell customers what you will never ask for, as Ledger did with the 24-word recovery phrase.
5. Keep a bug bounty. It is how Ledger learned of this breach.

Leaked home addresses also raise physical risk. See our explainer on wrench attacks.

For a case where stolen API keys moved money, read the 3Commas API key leak. Ledger's later incident came through a published library: the Connect Kit attack.

How an API Pentest Tests This

Guardian's API Pentest starts from the premise on its page: "API keys are long-lived and trusted on every call."

It tests what each key can reach, and what happens when one is used from somewhere new. The areas the page lists include:

• Key scoping: permission granularity, true read-only, IP allowlisting, expiry and instant revocation.
• Endpoint authorization: per-object checks, tenant isolation and mass assignment.
• Surface discovery: undocumented, deprecated and staging endpoints still reachable in production.
• Abuse resistance: rate limits, quotas and replay protection, and whether they hold per key.

Every endpoint is tested at each privilege level, across REST, GraphQL, gRPC and custom protocols. The test is scoped by endpoint count and the roles behind them.

It sits alongside Guardian's other offchain pentests, including web app and infrastructure testing.

Frequently Asked Questions

Were Ledger hardware wallets or crypto funds affected?

Ledger says no. The breach exposed e-commerce and marketing data, not devices, Ledger Live, payment details or funds. The risk fell on the people named: phishing, fake software and fear of physical targeting.

How many Ledger customers were exposed?

Ledger's July 2020 notice counted about 1 million emails and 9,500 detailed records. The December dump held 1,075,382 emails and 272,853 buyer records, per Threatpost and Cointelegraph.

How did Ledger find out about the breach?

A researcher in its bug bounty program reported a potential breach on July 14, 2020. Ledger's investigation then found the database had been accessed on June 25.

What should teams learn from the Ledger data breach?

Scope every API key to the least data it needs, log what each key reads, and test keys the way an attacker holding one would. Treat customer lists as sensitive data.

Sources

• Ledger: Addressing the July 2020 e-commerce and marketing data breach (July 29, 2020)
• Ledger: Message by Ledger's CEO, Update on the July data breach (December 21, 2020)
• Threatpost: Hacker Dumps Crypto Wallet Customer Data; Active Attacks Follow (December 21, 2020)
• Cointelegraph: Ledger users threaten legal action after hacker dumps personal data (December 20, 2020)
• Guardian: API Penetration Testing