Ledger faces $500M class-action suit over data breaches

A class-action lawsuit seeking $500 million claims that crypto wallet maker Ledger failed to protect customer safety by not preventing and reacting to a series of data breaches.

Filed on August 27, the lawsuit was brought by Douglas Kim, a Ledger user who says he lost nearly $2 million to criminals who used data taken from the company in 2020 and 2023 to target his digital assets.

The lawsuit alleges that around the time of the incidents, Ledger showed “a disturbing pattern of negligent, reckless, and irresponsible behavior with regard to its security posture and a callous disregard for its obligations to the privacy of its customers’ [personally identifiable information].”

Ledger faces repeated breaches

During the 2020 incident, the personal information of nearly 300,000 Ledger users was leaked and placed on a marketplace for stolen data.

The 2023 phishing attack, aimed at a Ledger employee, led to the distribution of malware that could redirect cryptocurrency from Ledger wallets to the attackers.

Not mentioned in the lawsuit is the 2026 data breach, in which Ledger users' personal data was exposed when payments processor Global-e suffered a hack.

Scammers target Ledger users with letters aimed at stealing recovery phrases

Regarding the 2020 and 2023 cases, the lawsuit claims Ledger downplayed the breaches, did not notify customers promptly, and refuses to “rectify and bolster its inadequate security measures to prevent data breaches.”

The lawsuit contends that criminals exploited the leaked data to target users and steal cryptocurrency, “resulting in substantial financial losses that would have been prevented, or that class members would have been able to guard against, had Ledger taken responsible and complete steps to notify its customers.”

Additionally, the lawsuit asserts that Ledger violated New York's Stop Hacks and Improve Electronic Data Security Act and acted negligently.

The suit demands between $500 million and billions of dollars in damages and requests a trial by jury.

Ledger declined to comment on the lawsuit, telling Protos it does not discuss legal matters.