Ledger Hit by Another Data Breach: Customer Information Exposed via Third-Party Partner Global-e

In early 2026, hardware wallet manufacturer Ledger found itself at the center of yet another security incident — this time stemming from a breach at its e-commerce and payment processor, Global-e.

On January 5, 2026, renowned blockchain investigator ZachXBT alerted the crypto community via X (formerly Twitter), sharing a notification email sent to affected customers. The breach exposed personal details such as names, postal addresses, email addresses, phone numbers, and order information for some Ledger shoppers.

Ledger Hit by Another Data Breach: Customer Information Exposed via Third-Party Partner Global-e Global-e, an Israel-based platform specializing in cross-border e-commerce solutions, detected "unusual activity" in a portion of its cloud-based network. The company quickly contained the incident, secured its systems, and engaged independent forensic experts for a full investigation.

According to notifications and statements, unauthorized access targeted order data from multiple brands, not just Ledger. Importantly, no payment card details, account credentials, passwords, seed phrases, private keys, or cryptocurrency balances were compromised.

Ledger swiftly clarified that the incident did not involve its own platforms, hardware devices, or software. "This was not a breach of Ledger’s platform, hardware or software systems, which remain secure," the company stated.

Only customers who purchased products on Ledger.com using Global-e as the "Merchant of Record" — typically for international orders — were potentially impacted. Ledger emphasized its self-custodial nature: Global-e has no access to users' 24-word recovery phrases or digital assets.

A Recurring Headache for Ledger Users

Ledger Hit by Another Data Breach: Customer Information Exposed via Third-Party Partner Global-e This is far from Ledger's first brush with data exposure. The most notorious incident occurred in 2020, when a breach of Ledger's e-commerce and marketing database — linked to partner Shopify — compromised over 1 million email addresses and detailed personal information (including physical addresses and phone numbers) for approximately 272,000 customers. Among those affected were 4,865 users from Russia.

The fallout was severe and long-lasting. For years afterward, Ledger customers reported receiving sophisticated phishing campaigns via email, SMS, and even physical mail. Scammers exploited the leaked data to craft convincing messages urging victims to "update" their wallets or reveal recovery phrases, often leading to drained accounts.

Other incidents have plagued Ledger since:

In 2023, a supply-chain attack on the Ledger Connect Kit drained nearly $500,000 from connected decentralized apps.
Separate phishing waves in 2025 targeted users with fake postal mail containing QR codes designed to steal seed phrases.

These repeated exposures have eroded trust for some in the community, with ZachXBT himself advising users to consider alternatives or use minimal/false personal info when buying hardware wallets.

Broader Implications for Crypto Security

Ledger Hit by Another Data Breach: Customer Information Exposed via Third-Party Partner Global-e The Global-e breach underscores a persistent vulnerability in the crypto ecosystem: third-party risks.

Even companies like Ledger, which excel at securing private keys offline, rely on external vendors for online sales and payments. Global-e serves major brands like Adidas, Disney, Hugo Boss, and Marks & Spencer, illustrating how one compromise can ripple across industries.

No exact number of affected Ledger customers has been disclosed, but the incident highlights the value of leaked PII to attackers. Names and contacts enable highly targeted social engineering—phishing emails pretending to be from Ledger support, fake recovery services, or even physical threats in extreme cases.

Ledger and Global-e are notifying affected individuals and regulators directly.

Both urge vigilance:

Never share your 24-word recovery phrase.
Ignore unsolicited communications claiming urgent action.
Use "Clear Signing" features to verify transactions on-device.
Enable two-factor authentication and consider hardware security keys.

Ledger Hit by Another Data Breach: Customer Information Exposed via Third-Party Partner Global-e As phishing scams stole nearly $84 million from crypto users in 2025 alone (per ScamSniffer), this latest breach serves as a stark reminder: while hardware wallets like Ledger protect assets exceptionally well when used correctly, the human element—and supply chain — remains the weakest link.

For Ledger owners, your crypto is safe if properly self-custodied. But expect an uptick in scam attempts. Stay paranoid — it's the best defense in this space.

Also read:

Thank you!