Ledger has confirmed the attack began because “a former Ledger employee fell victim to a phishing attack.”