According to information, a hacker stole the personal data of users of popular hardware wallets through an exploit on the Shopify platform.
In short:
Stolen data
According to the “Under The Breach” service for monitoring data breaches, a hacker from the Ethereum forum gained access to the user databases of Trezor and Ledger’s hardware wallets. The database is currently on sale, but it is not known if the data is not false.
The Ethereum forum hacker is now selling the databases of @Trezor and @Ledger.
— Under the Breach (@underthebreach) May 24, 2020
Both of which obtained from a @Shopify exploit.
(suggesting there are many more underground leaks).
The hacker also claims he has the full SQL database of famous investing site @BankToTheFuture. pic.twitter.com/4M3f2bQKvB
They also report that a hacker may have accessed the databases by an exploit in the Shopify platform. If the information provided by Under The Breach is true, the leakage of giants like Ledger and Trezor can only be the tip of the iceberg.
Answer by Ledger and Trezor
The hacker claims to have personal data of over 40,000 Ledger users, but without passwords. Shortly after the information about the data being stolen appeared, Ledger responded to the database violation in a statement on Twitter. Confirming that they are using Shopify, Ledger noticed that hacker screenshots do not correlate with their own database. The case is still being investigated
Rumors pretend our Shopify database has been hacked through a Shopify exploit. Our ecommerce team is currently checking these allegations by analyzing the so-called hacked db, and so far it doesn’t match our real db. We continue investigations and are taking the matter seriously.
— Ledger (@Ledger) May 24, 2020
The same cybercriminal claims to have the same personal information for over 27,000 Trezor users. On the other hand, Trezor noticed that he does not even use the Shopify platform, which affects the credibility of the hacker’s claims.
There are rumors spreading that our eshop database has been hacked thru a Shopify exploit. Our eshop does not use Shopify, but we are nonetheless investigating the situation. We've been also routinely purging old customer records from the database to minimize the possible impact.
— Trezor (@Trezor) May 24, 2020
What now?
Shopify itself, which according to the hacker managed to steal the data, claims that this cannot be true because the platform’s security system was investigated and no evidence was found to support such accusations.
On the other hand, the hacker was allegedly responsible for hacking the Ethereum forum in 2016. The criminal reported that “the data will only be sold for a lot of money”. The information sold by the hacker is the name, address, phone number and email to more than 80,000 users of a total of 3 most popular hard crypto wallets such as Ledger, Trezor and KeepKey.
The hacker’s actions do not stop there, currently, he is also trying to sell databases of 18 virtual crypto exchanges and forums. These include the Korean Korbit exchange, the Bitso trading platform and the BlockCypher, Nimirum and Plutus blockchain platforms.
A Bitso representative says that so far they have not found any evidence that a third party may have sufficient information to access client accounts. The Exchange’s cybersecurity team is currently under investigation.
Hackers still pose a major threat to the crypto market. Cybercriminals steal users’ data from the stock exchanges every year, causing a significant number of crypto-machines to disappear. Regular data leaks discourage potential investors and such events convince sceptics that the crypto market is still uncertain and dangerous.
