Ledger's customer file leaked twice in 2020 — CNIL fined it €750K in 2024

Ledger, the Paris-based maker of hardware wallets that guard customers' crypto, never had its vaults cracked — but its customer files were. Between May and June 2020, two hackers pulled the e-commerce file of about 290,000 buyers through Ledger's Shopify storefront: names, phone numbers, email and physical addresses. In June a second incident, attributed to an API-key flaw, exposed around a million newsletter subscribers.

The buyers' file was being sold privately by August 2020, and in December 2020 it was dumped for free on the RaidForums hacking forum: files listing 1,075,382 newsletter emails and 272,853 device buyers with names, mailing addresses and phone numbers. Owning a hardware wallet marks you as someone who holds crypto, so the addresses became targeting data. Owners were bombarded with phishing emails carrying fake Ledger Live apps that harvested recovery phrases, and scammers later mailed counterfeit replacement devices with letters impersonating Ledger's CEO.

Around fifty customers complained to France's CNIL. In October 2024 the regulator sanctioned Ledger for breaching two GDPR obligations — how long it kept customer data, and how that data was secured. The €750,000 fine was revealed by The Big Whale and confirmed by the CNIL to the outlet; the decision itself was not published. Ledger confirmed the sanction, stressing that its custody products were never exposed and that the incident concerned only its e-commerce activity.

A reported €750K fine for retention and security failures; 290K buyers' home addresses circulated on hacker forums for years.

For a wallet maker, a buyer's home address is targeting data: the leak fed years of phishing, fake-device mailings and extortion attempts against precisely the people most likely to hold crypto.

Retention duration was one of the two named GDPR failures — customer data kept long after it had commercial value is pure liability.

Security was the other: a storefront file reachable through Shopify and a leaking API key are ordinary attack surfaces that regulators expect to be hardened.

Once stolen, breach data has a long commercial life: sold privately within two months, published free within six, and still circulating when the fine landed four years later.

For a security company the customer file is security surface too. Home addresses of people who own vaults are targeting data — keep only what you need and guard what you keep.

The two hackers behind the e-commerce file were arrested, as The Big Whale revealed in March 2023; the API-key hacker was not. Ledger confirmed the sanction and maintains a public page tracking the phishing campaigns that still target its customers. The CNIL did not publish its decision but said anyone claiming damage can take the company to court. The scams evolved from email to post: counterfeit Nano devices mailed with CEO-impersonating letters urged buyers to switch to a replacement that would hand over their crypto — the breach replayed through customers' letterboxes.