More disturbing is that Ledger is untill now not informing customers about this. They (or a worker of them) must be involved in the scam.

And what about the customers home adress? Has this also been stolen?