Ledger Faces $500M Lawsuit Over Repeated Data Breaches and Crypto Theft
Crypto wallet manufacturer Ledger is at the center of a $500 million class action lawsuit filed on August 27, alleging systemic negligence in protecting customer data. The plaintiff, Douglas Kim, claims to have lost nearly $2 million after attackers exploited stolen personal information from Ledger’s 2020 and 2023 breaches to target his crypto assets.
The lawsuit outlines a pattern of security failures, including a 2020 breach that exposed the personal data of nearly 300,000 users, later sold on dark web marketplaces. In 2023, a phishing attack on a Ledger employee led to malware distribution, enabling attackers to redirect funds from users’ wallets. A separate 2026 breach unrelated to the lawsuit involved a hack of payments processor Global-e, further compromising Ledger users’ data.
The complaint accuses Ledger of downplaying the breaches, delaying customer notifications, and failing to strengthen security measures. It alleges that these lapses allowed criminals to exploit leaked data, resulting in preventable financial losses. The lawsuit also cites violations of New York’s Stop Hacks and Improve Electronic Data Security Act and seeks damages ranging from $500 million to potentially billions, along with a jury trial.
Ledger has declined to comment on the ongoing legal matter.
Source: https://cryptonews.net/news/legal/33393388/
Ledger cybersecurity rating report: https://www.rankiteo.com/company/ledgerhq
"id": "LED1788458082",
"linkid": "ledgerhq",
"type": "Breach",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Nearly 300,000 users (2020 '
'breach)',
'industry': 'Cryptocurrency',
'name': 'Ledger',
'type': 'Crypto Wallet Manufacturer'}],
'attack_vector': ['Phishing', 'Exploitation of Stolen Data', 'Malware'],
'data_breach': {'data_exfiltration': 'Yes (sold on dark web)',
'number_of_records_exposed': 'Nearly 300,000 (2020 breach)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High (personally identifiable '
'information, crypto assets)',
'type_of_data_compromised': ['Personal Data',
'Crypto Wallet Information']},
'date_publicly_disclosed': '2020, 2023, 2026',
'description': 'Crypto wallet manufacturer Ledger is at the center of a $500 '
'million class action lawsuit filed on August 27, alleging '
'systemic negligence in protecting customer data. The '
'plaintiff, Douglas Kim, claims to have lost nearly $2 million '
'after attackers exploited stolen personal information from '
'Ledger’s 2020 and 2023 breaches to target his crypto assets. '
'The lawsuit outlines a pattern of security failures, '
'including a 2020 breach that exposed the personal data of '
'nearly 300,000 users, later sold on dark web marketplaces. In '
'2023, a phishing attack on a Ledger employee led to malware '
'distribution, enabling attackers to redirect funds from '
'users’ wallets. A separate 2026 breach unrelated to the '
'lawsuit involved a hack of payments processor Global-e, '
'further compromising Ledger users’ data.',
'impact': {'brand_reputation_impact': 'Accusations of negligence and '
'downplaying breaches',
'data_compromised': 'Personal data of nearly 300,000 users (2020), '
'crypto wallet funds (2023)',
'financial_loss': '$500M (lawsuit claim)',
'identity_theft_risk': 'High (personal data sold on dark web)',
'legal_liabilities': 'Violations of New York’s *Stop Hacks and '
'Improve Electronic Data Security Act*',
'operational_impact': 'Delayed customer notifications, failure to '
'strengthen security measures',
'payment_information_risk': 'High (crypto wallet funds redirected)',
'systems_affected': ['Ledger’s customer database',
'User crypto wallets']},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes (2020 breach data)',
'entry_point': 'Phishing attack on Ledger employee '
'(2023)',
'high_value_targets': 'Crypto wallet users'},
'investigation_status': 'Ongoing (legal matter)',
'motivation': ['Financial Gain', 'Data Exfiltration'],
'post_incident_analysis': {'root_causes': ['Systemic negligence in protecting '
'customer data',
'Delayed security improvements']},
'references': [{'source': 'Class Action Lawsuit Filing'}],
'regulatory_compliance': {'legal_actions': ['$500M class action lawsuit'],
'regulations_violated': ['New York’s *Stop Hacks '
'and Improve Electronic '
'Data Security Act*']},
'response': {'communication_strategy': 'Delayed customer notifications, '
'downplayed breaches'},
'title': 'Ledger Faces $500M Lawsuit Over Repeated Data Breaches and Crypto '
'Theft',
'type': ['Data Breach', 'Phishing Attack', 'Malware Distribution']}