Ledger has confirmed the incident, saying the vulnerability may have originated with the distributor CryptoBillis.

Customers who bought a Ledger wallet through this distributor are advised not to set it up. Those who have already used it should transfer their assets to a completely independent new wallet.
$BTC $ETH