Ledger sued for $500M over alleged data breach and crypto theft

cryptonews

1 hour ago

Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers | Global Stocks, Options & Futures Trading App","description":"Tiger Brokers, one-stop investment in US stocks, SGX stocks, HK stocks, A-shares & other global assets. One of the best stock trading platforms in Singapore.","keywords":"tiger brokers,tiger trade,tiger brokers singapore,broker online,stock trading in singapore,share trading singapore,brokerage firm singapore,trading app,stock broker singapore,stock trading platforms,trading account","social":{"ogDescription":"Tiger Brokers, one-stop investment in US stocks, SGX stocks, HK stocks, A-shares & other global assets. One of the best stock trading platforms in Singapore.","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://au1.tigerplaytime.com/news/2664268827"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"SGP","license":"TBSG","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2664268827\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2664268827?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-09-03 16:11","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2664268827","market":"us","top_or_hot":-1,"title":"Ledger sued for $500M over alleged data breach and crypto theft","media":"cryptonews","content":"<div>\n<p>Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to ...</p>\n\n<a href=\"https://crypto.news/ledger-sued-for-500m-over-alleged-data-breach-and-crypto-theft/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Ledger sued for $500M over alleged data breach and crypto theft</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nLedger sued for $500M over alleged data breach and crypto theft\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-09-03 16:11 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/ledger-sued-for-500m-over-alleged-data-breach-and-crypto-theft/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to ...</p>\n\n<a href=\"https://crypto.news/ledger-sued-for-500m-over-alleged-data-breach-and-crypto-theft/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"UCYB","symbol_name":"ProShares Ultra Nasdaq Cybersecurity ETF","start_time":0,"source_url":"https://crypto.news/ledger-sued-for-500m-over-alleged-data-breach-and-crypto-theft/","article_id":"2664268827","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/ledger-sued-for-500m-over-alleged-data-breach-and-crypto-theft/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2664268827","pubTimestamp":1788423093,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to cryptocurrency theft and other financial losses.Ledger faces a proposed class action seeking at least $500 million over alleged security and disclosure failures tied to a December 2023 incident.Plaintiff Douglas Kim alleges scammers used compromised customer information to impersonate Ledger representatives before stealing nearly $1.95 million in crypto.The complaint cites Ledger’s 2020 breach affecting more than 270,000 customers as part of an alleged pattern of inadequate data safeguards.The lawsuit brings seven causes of action and seeks actual, compensatory, statutory, treble and punitive damages.Ledger lawsuit centers on December 2023 security incident. crypto.news previously reported that a former Ledger employee was phished before an attacker used the compromised access to publish maliciou","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"UCYB":"ProShares Ultra Nasdaq Cybersecurity ETF","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","HAKY":"Amplify HACK Cybersecurity Covered Call ETF","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","GDLC":"Grayscale CoinDesk Crypto 5 ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","STCE":"Schwab Crypto Thematic ETF","PSWD":"XTRACKERS CYBERSECURITY SELECT EQUITY ETF","TEKX":"SPDR Galaxy Transformative Tech Accelerators ETF","BITW":"Bitwise 10 Crypto Index ETF","SPAM":"THEMES CYBERSECURITY ETF","WFH":"Direxion Work From Home ETF","BKCH":"AdvisorShares Sabretooth ETF","DIME":"CoinShares Altcoins ETF","CRWC":"Corgi CRWD 2x Daily ETF","WCBR":"WisdomTree Cybersecurity Fund","CRWL":"2倍做多CRWD ETF-GraniteShares","DAPP":"VanEck Digital Transformation ETF","BITQ":"Bitwise Crypto Industry Innovators ETF"},"translate_title":"Ledger 因涉嫌数据泄露和加密货币盗窃被起诉 5 亿美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"CRPT":1.5,"UCYB":1.5,"STCE":1.5,"BKCH":1.5,"WCBR":1.5,"GDLC":1.5,"DIME":1.5,"WFH":1.5,"CRWL":1.5,"DAPP":1.5,"NCIQ":1.5,"LFGY":1.5,"PSWD":1.5,"BITQ":1.5,"HAKY":1.5,"BITW":1.5,"SPAM":1.5,"TEKX":1.5,"CRWC":0.6},"content_text":"Ledger has been hit with a proposed class action seeking at least $500 million over allegations that poor security and disclosure failures tied to a December 2023 incident exposed customers to cryptocurrency theft and other financial losses.\n\n\nSummary\n\n\n\nLedger faces a proposed class action seeking at least $500 million over alleged security and disclosure failures tied to a December 2023 incident.\nPlaintiff Douglas Kim alleges scammers used compromised customer information to impersonate Ledger representatives before stealing nearly $1.95 million in crypto.\nThe complaint cites Ledger’s 2020 breach affecting more than 270,000 customers as part of an alleged pattern of inadequate data safeguards.\nThe lawsuit brings seven causes of action and seeks actual, compensatory, statutory, treble and punitive damages. \n\n\n\nThe complaint, filed by Douglas Kim in the U.S. District Court for the Southern District of New York on Aug. 27, accuses the hardware wallet maker of failing to adequately protect customer personally identifiable information and cryptocurrency security data. Kim brought the case individually and on behalf of a proposed nationwide class.\nKim alleges that Ledger failed to properly notify customers after the December 2023 security incident and did not fully disclose its scope. The lawsuit claims hackers later used customer contact information to impersonate Ledger representatives and gain access to customers’ cryptocurrency wallets and private keys.\nThe complaint brings seven causes of action, including claims under New York General Business Law Sections 349 and 350, negligence, negligent misrepresentation, promissory estoppel and breach of the implied covenant of good faith and fair dealing.\nLedger lawsuit centers on December 2023 security incident\nThe December 2023 incident involved Ledger Connect Kit, a software library used to connect hardware wallets with websites and decentralized applications.\nThe complaint says attackers gained access to the NPMJS account of a former Ledger employee through a phishing attack. Ledger had failed to properly revoke the former employee’s access after their employment ended, according to the filing.\nLedger acknowledged the access control failure at the time, stating that the former employee’s NPMJS access had not been properly revoked.\nOnce inside the account, the attackers uploaded a malicious version of Ledger Connect Kit that could redirect transactions to addresses they controlled by inducing users to approve malicious transactions. Ledger publicly acknowledged that the malicious software could trick users into signing transactions that drained their wallets.\ncrypto.news previously reported that a former Ledger employee was phished before an attacker used the compromised access to publish malicious code. Ledger CEO Pascal Gauthier said at the time that the incident was isolated to third party applications and that Ledger hardware wallets remained unaffected.\nEstimates at the time put losses from the Connect Kit exploit between roughly $480,000 and $600,000. Ledger later said it would reimburse affected users and announced plans to phase out blind signing for Ethereum virtual machine decentralized applications.\nThe new lawsuit goes beyond losses reported immediately after the Connect Kit compromise. Kim alleges that hackers accessed and used Ledger customer PII, including names, email addresses and phone numbers, and that Ledger failed to provide customers with sufficient warning about the incident.\nPlaintiff says scammers stole nearly $1.95 million in crypto\nKim, who first bought a Ledger hardware wallet around 2017 and purchased a Nano X in New York City in 2021, says he later became the victim of a Ledger impersonation scheme.\nOn Feb. 18, 2025, Kim received a call from someone claiming to represent Coincover, which the caller presented as a department within Ledger, according to the complaint. The caller allegedly told Kim that someone in the Netherlands had attempted to register for Ledger Recover using his information and that his cryptoassets could be at risk.\nA second person then contacted Kim while posing as another Ledger representative and asked him to check his email as proof that the caller was legitimate.\nKim received what appeared to be an email from Ledger, the filing says. The complaint alleges, on information and belief, that the attackers used customer contact information originating from the December 2023 incident to identify him as a Ledger customer and trigger the email. Kim reserved the right to amend that allegation after obtaining Ledger’s breach forensics and incident response records through discovery.\nThe purported representative directed Kim to a website designed to resemble Ledger’s services and instructed him to enter his confidential passphrase to reset the device, according to the lawsuit. Kim complied and was given what he believed was a replacement passphrase.\nTwo days later, Kim checked his holdings and discovered that cryptoassets valued at $1,948,074 had been stolen, the complaint alleges. He has not recovered any of those assets.\nLedger customers have continued to face impersonation attempts. In February 2026, scammers sent fake Ledger letters directing recipients to phishing websites designed to collect wallet recovery phrases.\nSimilar physical mail attacks were reported in April 2025, when scammers reportedly used data leaked in 2020 to send Ledger branded letters containing QR codes that directed customers to websites seeking their recovery phrases.\nComplaint points to Ledger’s 2020 data breach\nKim’s lawsuit uses Ledger’s earlier security history to support its allegations of inadequate safeguards.\nA 2020 breach affected more than 270,000 Ledger customers, according to the complaint, exposing information that included names, physical addresses and phone numbers. The data later became available on black market channels online. Litigation over that breach was separately brought in the Northern District of California.\nThe new complaint alleges Ledger failed to sufficiently improve its security practices following that incident and accuses the company of downplaying both the earlier breach and the December 2023 incident.\nKim argues that Ledger’s security representations were particularly important because the company requires customers to provide information when buying its products. The complaint lists names, email addresses, delivery addresses, phone numbers, payment details, product information and order amounts among the customer data collected by Ledger.\nLedger has advertised security measures including encryption, employee training, role based authentication, two factor authentication, continuous system monitoring and independent security testing, according to statements reproduced in the complaint.\nThe lawsuit alleges those representations were deceptive because Ledger failed to implement adequate measures to protect customer information and did not sufficiently address foreseeable risks after earlier cybersecurity incidents.\nSecurity questions around Ledger resurfaced in August when the company said an Ethereum signing flaw was fixed before another security company publicly disclosed the issue. Ledger CTO Charles Guillemet said users running updated firmware and applications were protected, while no independently verified thefts linked to that specific vulnerability had been reported at the time.\nDays later, Ledger rejected claims it was hacked after OneKey’s security team reproduced a transaction substitution flaw using an outdated version of Ledger’s Ethereum application. Ledger said protections had already been added in a newer application version.\nClass action seeks at least $500 million\nKim proposes a nationwide class covering U.S. individuals whose PII, cryptoassets, cryptocurrencies or crypto credentials were compromised as a result of the alleged data breach and who suffered financial losses, unauthorized transactions or identity theft mitigation costs. The complaint says the proposed class could number in the thousands.\nA separate New York subclass would cover qualifying customers whose transactions with Ledger, including product or service purchases or the creation of Ledger accounts, occurred in New York.\nThe complaint estimates Kim’s damages at approximately $2 million and claims collective class damages could reach at least $500 million, potentially running into billions of dollars depending on the number of customers affected and the size of individual losses. Those figures are estimates advanced by the plaintiff and have not been established by the court.\nKim’s filing seeks declarations that Ledger violated New York’s SHIELD Act and General Business Law Sections 349 and 350, along with findings of negligence and negligent misrepresentation. The requested relief includes actual, compensatory, statutory, treble and punitive damages, as well as attorneys’ fees and costs.\nThe plaintiff has demanded a jury trial.\n\n\n\n\n\n                Read more:\n            \n\n                XRP Ledger tested by BIS researchers for data checks","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"policyRegulatory","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}