Back Securityweek

Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

Securityweek • September 11, 2026

Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company was hacked.

The incident involved the marketing platform Brevo, which Trezor uses for newsletters. Brevo said an attacker exploited how it handles SAML Single Sign-On (SSO) to access 138 accounts.

“The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration. Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behavior for SSO,” Brevo explained .

“This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach,” it added.

According to the company, the attacker sent phishing messages to the email addresses stored under six of the compromised accounts. In addition, the threat actor exfiltrated contacts from 43 accounts.

One of the customers whose email list was abused for a phishing campaign appears to be Trezor, which informed customers on Thursday that the attacker sent phishing messages to 347,000 email addresses stored in the Brevo account.

The phishing emails had the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and contained a link pointing to a malicious website.

Trezor has not shared details the malicious site, but warned customers that their funds could be lost if they clicked on the link and entered their wallet backup.

According to Trezor, only 2,500 users clicked on the link before the malicious website was taken offline 20 minutes after the incident was detected. It’s unclear how many users may have lost funds and how much.

Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit by the Brevo hack, but they haven’t shared details on the impact and have not named Brevo as the source of the incident.

The incident comes less than a month after Trezor admitted that the personal information of nearly 14,000 people was compromised in a data breach affecting its third-party shipping provider ShipMonk.

An update Trezor shared on September 4 revealed that the ShipMonk leak affects an additional 67,000 US customers, including their name, email, shipping address, phone number, and order number.

Both incidents could lead to a surge in phishing attacks targeting Trezor customers.

Related : Surfshark Systems Targeted by Hackers

Related : 4.1 Million Impacted by AdaptHealth Data Breach

Related : Mathspace Data Breach Exposes Over 1 Million People

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Phishing Attack Targets 347K Trezor Users via Brevo Breach A security flaw in Brevo's login system allowed an attacker to access 138 customer accounts, including those of Trezor, BitBox, and CoinTracking. The attacker exploited a weakness in Brevo's single sign-on (SSO) system, leading to phishing emails sent to approximately 347,000 Trezor customers. Six accounts were used to distribute phishing emails, while contacts were exported from 43 accounts. The phishing emails, titled 'Critical Security Alert: STM32 Entropy Vulnerability,' contained links to malicious applications requesting wallet backups. Trezor took down the malicious domain within 20 minutes, but around 2,500 users clicked the link before it was disabled. Brevo has acknowledged the breach and is investigating the incident. Trezor is treating all email addresses in its Brevo account as potentially compromised. 11 sources 69

Extracted Entities

Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack

The full story

Extracted Entities

Attack Types (2)

Companies (5)

Domains (1)

MITRE ATT&CK (3)

Vulnerabilities (1)