The unfortunate Ledger saga continues as, following the massive data dump, people now claim they receive death treats in their native language, some say they’ve been sim-swapped, and others warn their emails are being used to set up Coinbase accounts. Meanwhile, the CEO said Ledger will not reimburse the affected customers because it would kill the company.
The hack-related troubles seem never-ending for Ledger and their customers as now death threats are becoming even more scarier. “I was in one of the 270k people. I am Polish,” wrote Reddit user ‘jurban84’ this morning (UTC time). The person behind the alleged email asked for PLN 1,000 (c. USD 270) to be sent to a bitcoin (BTC) address, threatening to kill the user if they don’t comply.
And apparently, the email looks quite genuine. “Normally, I would ignore it, but the email was written in perfect Polish, which google translate always struggles with, sender name is also correct Polish (unusual for phishing), it was sent from a Polish domain, and a Polish IP, play mobile network to be exact,” claimed ‘jurban84,’ adding “So thank you Ledger. For the first time I fear for my life.”
As a short reminder, Ledger announced this summer that it had suffered a data breach, after which numerous users reported numerous phishing attempts (and some successes) via emails and texts – and the situation culminated with hackers dumping a database reportedly containing more than a million email addresses and 270,000 physical addresses and phone numbers on Raidforums, a website for sharing hacked databases. This is the point when many suggested the abuse might escalate and turn from online to offline.
The Life of a Ledger User in 2020 from r/ledgerwallet
Many commenters to the original poster’s story said that this email was sent to thousands of people hoping to catch somebody, and advised the user to contact the police. Others argued that these things would work somewhat differently for people in some other countries: “They will even not receive an email, guys will show up directly on the door with a gun,” wrote ‘remsbk.’
User ‘relephants’ too reported getting an email with their name and city of residence, asking for USD 500, and threatening them with a “wrench […] against their face,” adding “I’m not afraid to invade your home, I don’t want to make this any harder than it has to be.”
Other people reported not death threats, but SIM swaps and attempts to get into accounts on major crypto exchange Coinbase, pointing out a distinct irony of the situation. Reddit user ‘b3nsf’ claimed that the attackers “started changing my passwords and tried to log into my Coinbase account,” posting the alleged attacker’s IP address. “I don’t have any BTC on my account at Coinbase, but yeah, that’s why I bought those damn ledgers to begin with..,” said the poster.
Many more have warned users about SIM swap attacks, with some, like ‘TrueSpins’, arguing that “the biggest danger isn’t home invasions – it’s online attacks. The crypto stuff aside, the combination of address, full name and telephone numbers is very valuable to a hacker.”
Some say that their attackers tried creating whole new Coinabse accounts with their email, which commenters suspect is done to check who has an account already so they could send Coinbase phishing emails. “I checked my email and it apparently has had like 30 unsuccessful login attempts from around the world,” said ‘xenvy04.’
Meanwhile, Ledger CEO Pascal Gauthier stated that the company will not be providing any compensation for users whose personal data was leaked online, focusing on providing more security instead. Reimbursing a million users for “a data breach of this magnitude for such a small company” would “just kill the company,” the CEO was quoted as saying by Decrypt. Gauthier added that these threatening emails are “just an online scam to scare you with these tactics” and that it’s unlikely the threats are real.
Here are a few clear recommendations on how to react to the breach. Thank you @serhack_ for putting this together.https://t.co/92GAyBy6oP
— Ledger (@Ledger) December 22, 2020
At the same time, users are continuing their discussions on a possible class-action lawsuit, with some stating that Ledger must pay the consequences and serve as an example to other companies. More specific work on this is being done at ‘Class Action Lawsuit Discussion Thread’ where people claim to have already contacted solicitors. One such solicitor is quoted as saying that “as the defendant appears to be French then the proper venue for bringing this claim will be the courts of France.”
___
Source: Cryptonews
