The important word here is unverified. A threat actor can claim a huge database, but until the records are independently validated, the responsible move is to treat the listing as a warning rather than confirmed evidence of a Ledger breach. Either way, it highlights why minimizing exposed personal data matters private crypto swaps like @Pegasusswap reduce the amount of identity information involved in a swap.