2026 Brevo — SAML SSO flaw; 138 client accounts (6 phishing; 43 contact exports); crypto brands hit
Data compromised
138 Brevo customer accounts accessed; contacts exported from 43 accounts; phishing emails sent from 6 accounts. Named merchant victims in trade press include Trezor (~347k newsletter phishing), CoinTracking, and BitBox. Aggregate contact census across all 43 exports not published.
Technical writeup
Verified Brevo status write-up — September 10, 2026 (UTC). Attacker exploited a SAML SSO handling flaw to access 138 Brevo accounts; contacts exported from 43; phishing from 6. Contained by 8:30 AM UTC same day. Trade press (The Record, Malwarebytes, SecurityWeek) identifies cryptocurrency merchants among phishing victims — Trezor (~347,000 newsletter addresses), CoinTracking (“refresh API keys” lure), and BitBox (newsletter warning). Additional Brevo customers among the 43 export / 6 send accounts may still disclose. recordsAffected 0 (no global contact census); companyConfirmed true.
Root cause
SAML SSO boundary flaw: attacker-created SSO org invitations wrongly granted access across invited users’ organizations
References
- https://status.brevo.com/incidents/pawbvhq8/write-up
- https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider
- https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
- https://therecord.media/trezor-bitbox-cointracking-phishing-crypto-holders
- https://www.malwarebytes.com/blog/news/2026/09/crypto-customers-targeted-by-scammers-after-email-marketing-provider-breach
- https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/
- https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE/write-up