Data leak β›“ Supply Chain

Ledger Customer Data Breach via Global-e Third-Party Ecommerce Platform

πŸ“… 2025-12-01 🏒 Global-e (international ecommerce and payments platform)
Primary Source β†—

Incident Details

Ledger (hardware crypto wallet manufacturer) disclosed in January 2026 that an unnamed unauthorized party accessed a Global-e cloud system used to process international orders. Global-e detected unusual activity, implemented controls, and launched a forensic investigation. Exposed data included customer names and contact information along with order details (products and prices). Payment data, passwords, wallet recovery phrases, and cryptocurrency holdings were not affected. The number of impacted customers was not disclosed. Global-e serves multiple brands, so Ledger was not the only company affected. This is the second major data breach involving Ledger customer data, following the 2020 Ledger database breach.

Technical Details

Initial Attack Vector
Unauthorized access to Global-e's cloud system storing order data for multiple brands including Ledger; initial access vector not publicly disclosed
Vendor / Product
Global-e (international ecommerce and payments platform)
Supply Chain Attack
βœ… Confirmed third-party / vendor compromise

Timeline

  1. 2025-12-01 Breach occurred
  2. 2026-01-05 Publicly disclosed
  3. 2026-01-05 Customers notified