2026 Trezor — Brevo email-provider breach; 347k newsletter emails; phishing via [email protected]
Data compromised
Opt-in newsletter database ~347,000 email addresses used to send phishing from [email protected] (fake STM32 entropy alert). ~2,500 users clicked before domain takedown (~20 minutes). No other Trezor systems touched per company.
Technical writeup
Verified Trezor notices — September 9–11, 2026. Brevo, Trezor’s third-party newsletter platform, suffered a security incident; Trezor initially cited ~120 Brevo accounts (Brevo status later detailed a SAML SSO boundary flaw affecting 138 accounts on Sep 10 UTC). Unauthorized actors sent phishing from [email protected] to Trezor’s opt-in newsletter list (~347,000 addresses) with a fake “STM32 Entropy Vulnerability” lure seeking wallet backups. Domain taken down within ~20 minutes; ~2,500 clickers before takedown. Distinct from ShipMonk fulfillment breach. recordsAffected 347000; companyConfirmed true.
Root cause
Brevo (third-party marketing/email platform) SSO/account compromise enabled unauthorized sends from Trezor’s newsletter account
References
- https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider
- https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
- https://www.bleepingcomputer.com/news/security/trezor-warns-users-of-email-provider-breach-phishing-attacks/
- https://status.brevo.com/incidents/pawbvhq8/write-up
- https://x.com/Trezor/status/2097786518110609620