This appears to be a ColdCard (firmware) specific issue.

Yeah.. But ledger is the little tyke of hardware wallets. It could probably happen to anyone. I dunno. Its Still over my head what happened.

Move to a hot wallet and then generate new keys using dice rolls is what I’m recommending for now.

What if they bought a mk4. Cold card says that model is safe.