So it would appear that the "authorized reseller" Was bought out in March of this year and forced to sign an NDA that prevented them from telling anybody that they had sold the business. The NDA expires in 10 days. It is now more likely that we're not dealing with a malicious employee, but probably a well-funded and relatively sophisticated bad actor, possibly DPRK. It is also likely that this is not the only third-party reseller that they attempted to buy. If you purchased a ledger (or other hardware wallet) from ANY reseller and not from Ledger directly, you should carefully and slowly move funds to a new device. If you do not have a new device, you can start with a 2-of-2 multisig where your ledger is one signer and a hot wallet is another. Use that in the interim until you have another hardware device. And in the long term, the safest way to store your self-custodied tokens remains a multisig (but not a 2/2, where loss of one key leads to loss of funds). Prefer 2/3 or 3/5.