As Ledger stated earlier, this leak doesn't contain passwords, recovery phrases, or payment information (customers' phrases are not stored in the first place) - which further underlines the warning not to share the 24-word recovery phrase with absolutely anybody, even if they say they are Ledger. "Since we discovered the data breach in June 2020, we worked with an external security organization to conduct a forensic review. The review confirmed that only 9,500 individuals were impacted, all of whom were personally contacted by Ledger Support. Since the phishing attacks started to occur, we anticipated more information could have leaked and continued to notify all users via Twitter and email," a Ledger spokesperson said.

Later, in an email to its clients, the company confirmed that:

"The database publicly released yesterday shows that a larger subset of detailed information has been leaked, approximately 272,000 detailed information such as postal address, last name, first name and telephone number of our customers. These details are not available in the logs that we were able to analyze."

"If you are part of the detailed personal information subset, you will receive a specific email notifying you within the next 24 hours (check your spam box)," they said, adding that they have taken down more than 170 phishing websites since the original breach.

There are some ways you can check if your information was leaked. Cybersecurity site haveibeenpwned.com, recommended by Ledger itself, said it had already listed 69% of the addresses since the original leak, and many commenters, such as Casa's Chief Technology Officer Jameson Lopp and Ethereum (ETH) core developer Hudson Jameson recommended checking if you're a part of the database leak there. might be wise to plan ahead and:

- email: use trashmail / yopmail to generate new random email addresses for every site
- phone: use an app generate fake #s or get a second phone to manage 2FA
- mail: get a PO box or mail forwarding service https://t.co/Ku25oz5b2R

— Meltem Demirors (@Melt_Dem) December 21, 2020