Data Breaches Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking. By Eduard Kovacs | September 11, 2026 (8:48 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Cold cryptocurrency storage provider Trezor says roughly 347,000 of its customers received phishing emails after a third-party marketing platform used by the company was hacked. The incident involved the marketing platform Brevo, which Trezor uses for newsletters. Brevo said an attacker exploited how it handles SAML Single Sign-On (SSO) to access 138 accounts. “The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration. Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behavior for SSO,” Brevo explained . “This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach,” it added. According to the company, the attacker sent phishing messages to the email addresses stored under six of the compromised accounts. In addition, the threat actor exfiltrated contacts from 43 accounts. One of the customers whose email list was abused for a phishing campaign appears to be Trezor, which informed customers on Thursday that the attacker sent phishing messages to 347,000 email addresses stored in the Brevo account. Advertisement. Scroll to continue reading. The phishing emails had the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and contained a link pointing to a malicious website. Trezor has not shared details about the malicious site, but warned customers that their funds could be lost if they clicked on the link and entered their wallet backup. According to Trezor, only 2,500 users clicked on the link before the malicious website was taken offline 20 minutes after the incident was detected. It’s unclear how many users may have lost funds and how much. Swiss Bitcoin hardware wallet maker BitBox and crypto tax calculator CoinTracking also appear to have been hit by the Brevo hack, but they haven’t shared details on the impact and have not named Brevo as the source of the incident. The incident comes less than a month after Trezor admitted that the personal information of nearly 14,000 people was compromised in a data breach affecting its third-party shipping provider ShipMonk. An update Trezor shared on September 4 revealed that the ShipMonk leak affects an additional 67,000 US customers, including their name, email, shipping address, phone number, and order number. Both incidents could lead to a surge in phishing attacks targeting Trezor customers. Related : Surfshark Systems Targeted by Hackers Related : 4.1 Million Impacted by AdaptHealth Data Breach Related : Mathspace Data Breach Exposes Over 1 Million People Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Widened Scan Turns Up Fourth Rogue Claude Cyber Incident Organizations Warned of Cisco Secure FMC Exploitation Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products Anthropic Details Response to Security Incidents, Unveils Enterprise Safeguards OpenAI’s Astra Crosses ‘Critical’ Cyber Threshold After Finding Zero-Days SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild Latest News Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison Check Point Patches Critical VPN Vulnerabilities Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance Surfshark Systems Targeted by Hackers Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion PaperCut Flaws Exploited in AI-Powered Attacks Mandiant Founder Kevin Mandia Joins Amazon Board Cybersecurity M&A Roundup: 33 Deals Announced in August 2026 Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the Move Zero Networks has named Yossi Dagan as Chief Financial Officer. Manifold has appointed Joe Sullivan to its Board of Directors. Patrick McKinney has joined Turing as Chief Information Security Officer. More People On The Move Expert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email