Lawyer Ariel Givner disclosed that hardware wallet manufacturer Ledger SAS has been hit with a class action lawsuit in the Southern District of New York, case number 1:26-cv-7307. Plaintiff Douglas Kim is suing on behalf of similar users, with the complaint dated August 27, 2026.

The complaint refers to the December 2023 security incident as a data breach, accusing the company of downplaying its severity and failing to disclose it in a timely and complete manner, resulting in the exposure of customers' personal identity information such as names, emails, and phone numbers, which were used to impersonate Ledger and induce approval of fraudulent transactions. Relevant information has reportedly flowed into the dark web and black market. The same complaint also states that around December 14, an NPMJS account used to release the Ledger Connect Kit was compromised by unauthorized personnel, leading to a malicious version that altered some users' transaction paths. At that time, the company claimed that an employee was phished, after which the attacker released a malicious library, with a window of less than two hours, resulting in reported on-chain losses of approximately $484,000, affecting multiple DeFi frontends using that library.

The plaintiff describes a previous 2020 case as a "malicious pattern": e-commerce and marketing databases were exported by internal personnel through Shopify and customer service outsourcing TaskUs, with about 272,000 records containing names, addresses, phone numbers, and orders publicly disclosed on forums in December of that year, along with approximately one million email addresses; the company initially reported about 9,500 individuals but later expanded notifications. The ongoing case in the Northern District of California, Baton/Seirafi (3:21-cv-02470), is still reviewing this leak. In January 2026, Global-e, the checkout and fulfillment partner, again exposed customer data related to orders, with the company stating that no payment card information was involved.

The allegations include violations of New York General Business Law Sections 349 and 350, negligence, negligent misrepresentation, estoppel, and implied contracts of good faith and fair dealing, citing notification obligations under New York's SHIELD Act. The complaint states that Ledger has sold approximately 7 million units, covering about 180 countries; plaintiff Kim is personally claiming at least $2 million, with collective damages hypothetically estimated to start at $500 million, with no upper limit. All these figures are claims made in the lawsuit and have not been confirmed by a judgment.

Who is buying and who is selling: The incident is driven by a security premium lawsuit, not by devices remotely extracting private keys. Funds are flowing from "self-custody is absolutely secure" marketing to legal fees, notification compliance, and third-party e-commerce risk control; benefiting are the plaintiffs who can connect phishing losses to delayed disclosures, while under pressure are hardware wallet manufacturers that tie chip security and order databases under the same brand. The chip remains intact, but the contact list has been compromised, shifting pricing power to whether it can be proven that "failure to timely inform led to avoidable authorizations."

The 2020 leak list was once quoted at about $100,000 among hackers; subsequently, there were instances of counterfeit device replacement packages and SMS phishing. The lawsuit aims to link supply chain poisoning, contact list leaks, and asset fraud into the same negligence chain.

Source: Public Information