Practical checklist if one of these landed in your inbox (applies to any hardware-wallet vendor phish):

• No real vendor ever needs your seed words. Any page, form, "recovery tool" or "support agent" asking for the 12/24 words, or to type them into a computer, is the attack. Full stop.
• Don't trust the sender name or even the domain. If the vendor's site/mail system itself is compromised, mail can pass SPF/DKIM and still be malicious. "It came from their real address" proves nothing this week.
• Firmware only via the device's own verification. Passport checks the signature on firmware itself; never install a file a mail links to, and never "update" through a link. Get updates from the path the official docs describe, after the vendor confirms the incident is cleaned up.
• The leaked data is the long tail. Name + postal address + email means follow-up phishing by SMS, phone and paper letters (Ledger 2020 leak: years of fake "replacement device" packages). Treat any unsolicited "replacement Passport" or "urgent migration" as hostile.
• If you clicked but entered nothing: probably fine; clear the browser session. If you entered seed words anywhere: assume the wallet is gone. From a clean device, create a new seed and sweep funds now, before the attacker's batch script gets to you.

Worth checking haveibeenpwned for your address once a dump shows up, so you know what the phishers have on you.