Cyber Threat Actor: Ledger Hacker

The threat actor known as Ledger Hacker has been associated with a security breach reported in mid‑2020. The alias Ledger Hacker is the primary name used in public reporting of this activity. Open‑source information indicates the actor is based in France. No additional aliases or affiliations have been publicly attributed to this actor. The actor’s activity to date consists of a single reported intrusion against a cryptocurrency wallet provider.

On 2020‑06‑25 the actor gained unauthorized access to the provider’s e‑commerce and marketing database. The breach exposed approximately one million customer email addresses together with personal data such as names, postal addresses, phone numbers and order details for thousands of individuals. Financial information, passwords and the security of the provider’s hardware wallets were not affected according to the disclosed findings. The intrusion was initially identified through a report submitted to the company’s bug bounty program, which prompted immediate patching of the vulnerable component. Subsequent investigation revealed that the actor had maintained prior access before the bug bounty report, leading the vendor to engage a cybersecurity firm for forensic analysis and regulatory notification. Following the incident the company undertook a broader security enhancement program to prevent similar compromises.