The ledger isn't really safe from the recent articles surfacing about the company which had a major data breach back in July of this year. Yet they hadn't done much to secure their devices nor protect their customers.
Could these email addresses that had been published to a subsequent forum be used to get those ledger users to click on link so whenever they connect their ledger to their pc to upgrade or whatever they want to do with it, it copies an address which is the hackers deposit address instead?
Who knows but that's what it sounds like happened to your crypto located this ledger, a so called secure&safe wallet.
The way that hardware wallets work is that they have a display and it shows the destination address, so if the computer gets infected with a virus which can change the destination address to the hackers, like the old clipboard attack, you will notice it on the screen on the hardware wallet. Most people check this before they proceed with the transaction.
But if you click a link, which modifies the firmware of your HW then its possible that it can display a fake link and send it to the hackers address instead. No idea how these people are getting all their coins stolen all of a sudden. Maybe some rogue employee patched fake firmware on certain HW from the factory, who knows.