Was the hardware wallet “preseeded”? There is an attack where a malicious reseller sends a unit with the seed previously generated, and a prefilled card of words. When the address is funded, the reseller can reclaim the coins.

The reason I suspect this is the attacker has swept the wallets to the same addr. This could represent a supply chain attack with a common attacker.