Breaches & scams
Customer data leaks and wallet-key theft are different problems
By Jolly Ledger editorial · Published · Reviewed · 4 min read
Short answer
Customer data helps attackers find or impersonate you; wallet secrets can give them control of the wallet. A customer-data leak is serious, but on its own it does not establish that your recovery phrase or private keys were stolen.
A company can lose your shipping address without losing the secrets that control your crypto. Someone can also steal your recovery phrase without breaching any manufacturer. These are different paths to harm, and the right response depends on which information or capability actually escaped.
Customer data identifies and persuades
Customer data may include an email address, name, phone number, delivery address or order history. It can reveal a relationship with a wallet company and support targeted phishing, unwanted contact or personal-safety concerns. It does not, by itself, authorize a transaction.
Trezor’s September 2026 Brevo notice describes exported newsletter addresses; Ledger’s revised 2020 disclosure describes a larger set of detailed customer records. Neither was a database of recovery phrases. The historical Ledger explainer shows why accurate scope still matters years later.
Wallet secrets provide a different capability
Private keys authorize spending. A recovery backup can recreate those keys, subject to the backup format and any extra requirement such as an optional passphrase. Someone holding enough of those secrets may not need your device or its PIN at all.
That is why replacing a device or changing its PIN does not make a copied recovery phrase secret again. Conversely, knowing your postal address does not supply a missing recovery phrase. Keep the roles of PIN, passphrase and backup separate when describing an incident.
| What escaped | Main concern | What it does not establish |
|---|---|---|
| Email or phone number | Targeted messages and impersonation | Possession of wallet keys |
| Shipping address and order details | Privacy loss and more persuasive targeting | Current holdings or spending authority |
| Public wallet address | Transaction visibility and possible identity linkage | The private key needed to spend |
| Recovery words or private key | Potential control of the wallet | That waiting for a balance change is safe |
A data leak can lead to a second incident
Personalization shows a sender knows something about you, not that they are authorized. Scammers also invent breaches to explain why they need urgent cooperation. Verify the incident independently, and never provide secrets to “prove ownership”.
Choose the response that matches the exposure
- For contact-data exposure, keep suspicious messages and verify support independently.
- If login credentials for an affected service were exposed too, secure that account using the provider’s own instructions.
- For downloads or approvals, describe exactly what happened to verified official support.
- For disclosed recovery words or private keys, seek urgent official guidance without sending the secrets again.
- For credible threats involving your address, prioritize personal safety and local help.
Observation is not proof of safety
A normal balance does not show whether a backup was copied; a flood of spam does not prove it was. Record what you can establish, then follow the vendor’s own instructions for that specific exposure. Generic reset or transfer recipes can add mistakes without fixing the real problem.
If recovery words were shared, the next step is not another online form. Use the guide to finding the right official help, and see the breach triage checklist for vendor incidents.
Sources
- Security incident at Brevo, our third-party email provider — TrezorExample of newsletter-address exposure distinguished from wallet systems.
- A message from Ledger’s CEO about the data leak — LedgerHistorical example of detailed customer records exposed via an e-commerce database.
- Identify phishing scams — BitBox
Reported facts are attributed to their sources. Spotted an error? Read our corrections approach.
Turn this into a preparation plan
Answer 16 calm questions about your setup. Get findings, scenario walkthroughs and a family briefing — on your own device, no account, no wallet connection, no recovery words.