Data leak
β Supply Chain
Ledger Customer Data Breach via Global-e Third-Party Ecommerce Platform
Primary Source βIncident Details
Ledger (hardware crypto wallet manufacturer) disclosed in January 2026 that an unnamed unauthorized party accessed a Global-e cloud system used to process international orders. Global-e detected unusual activity, implemented controls, and launched a forensic investigation. Exposed data included customer names and contact information along with order details (products and prices). Payment data, passwords, wallet recovery phrases, and cryptocurrency holdings were not affected. The number of impacted customers was not disclosed. Global-e serves multiple brands, so Ledger was not the only company affected. This is the second major data breach involving Ledger customer data, following the 2020 Ledger database breach.
Technical Details
- Initial Attack Vector
- Unauthorized access to Global-e's cloud system storing order data for multiple brands including Ledger; initial access vector not publicly disclosed
- Vendor / Product
- Global-e (international ecommerce and payments platform)
- Supply Chain Attack
- β Confirmed third-party / vendor compromise
Timeline
- 2025-12-01 Breach occurred
- 2026-01-05 Publicly disclosed
- 2026-01-05 Customers notified