{"id":"brevo-trezor-subscriber-phishing-sep-2026","category":"scam","status":"closed","title":"Brevo breach enabled wallet-backup phishing against 347,000 Trezor subscribers","tldr":"Attackers used Trezor’s email provider to send wallet-backup phishing to about 347,000 subscribers. Delete the message. If you disclosed your backup, immediately move your funds to a new wallet.","summary":"Attackers breached Brevo, Trezor’s newsletter provider, and sent subscribers a fake hardware-security warning designed to obtain their wallet backups. Brevo’s single sign-on handling allowed access beyond the intended organisation. Its investigation counted 138 accessed accounts, six used for phishing and 43 with exported contacts; Trezor’s statement still quotes the earlier total of 120. Brevo blocked access on 10 September and marked the incident resolved, although its write-up described the permanent single sign-on fix as still being deployed. Trezor notified recipients and disabled the phishing link. On 17 September it confirmed that 347,149 subscriber email addresses had been exported. Trezor said its products, wallets and account systems were unaffected. As of 3 November, the reviewed sources disclose no confirmed financial-loss total or recovery outcome. The stolen addresses remain a risk for further phishing; there is no device update that reverses their exposure.","action":"Delete the fraudulent security email and never provide your wallet backup through an email link or downloaded app. If you entered your backup, follow Trezor’s official guidance and immediately move your funds to a new wallet. Check future warnings directly on Trezor’s website or in Trezor Suite.","product":"Trezor newsletter subscribers and Brevo customer accounts","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["brevo","trezor","phishing","crypto","data-breach"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Attacker gained access to client accounts — write-up","url":"https://status.brevo.com/incidents/pawbvhq8/write-up","by":"Brevo","date":"2026-09-10"},{"kind":"advisory","title":"Security incident at Brevo, our third-party email provider","url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider","by":"Trezor","date":"2026-09-17"},{"kind":"advisory","title":"Attacker gained access to client accounts — resolved","url":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE","by":"Brevo","date":"2026-09-10"},{"kind":"news","title":"Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack","url":"https://www.securityweek.com/trezor-says-347000-users-received-phishing-emails-after-brevo-hack/","by":"SecurityWeek","date":"2026-09-11"},{"kind":"news","title":"Crypto customers targeted by scammers after email marketing provider breach","url":"https://www.malwarebytes.com/blog/news/2026/09/crypto-customers-targeted-by-scammers-after-email-marketing-provider-breach","by":"Malwarebytes","date":"2026-09-11"}],"started":"2026-09-09","closed":"2026-09-17","created":"2026-11-03T21:23:57.374Z","updated":"2026-11-03T21:23:57.374Z","cve_notes":[],"timeline":[{"at":"2026-09-17","added":"2026-11-03T21:16:05.524Z","kind":"vendor-revised","text":"Trezor confirmed that 347,149 newsletter email addresses had been exported, leaving subscribers exposed to further targeted phishing.","url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider","by":"Trezor","patch":null},{"at":"2026-09-10T08:30Z","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Brevo blocked the access route and signed out all users. Its write-up said attacker access had ended, while a permanent fix to restrict single sign-on access to the correct organisation was being deployed.","url":"https://status.brevo.com/incidents/pawbvhq8/write-up","by":"Brevo","patch":null},{"at":"2026-09-10T06:30Z","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Brevo detected abuse of its single sign-on handling. It confirmed access to 138 customer accounts, phishing sent from six accounts and contact exports from 43.","url":"https://status.brevo.com/incidents/pawbvhq8/write-up","by":"Brevo","patch":null},{"at":"2026-09-10","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Brevo marked the account-access incident resolved and said affected services were operating normally.","url":"https://status.brevo.com/incidents/01M266V1CZKJQNGZRNEGFD5CQE","by":"Brevo","patch":null},{"at":"2026-09-10","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Trezor said it had notified all recipients and disabled email sending. It reported disabling the phishing link within 20 minutes, after approximately 2,500 people had clicked.","url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider","by":"Trezor","patch":null},{"at":"2026-09-09","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"According to Trezor, attackers used its Brevo newsletter account to send approximately 347,000 subscribers a fraudulent security warning. It directed recipients to an app that requested their wallet backup.","url":"https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider","by":"Trezor","patch":"na"}],"url":"https://hard.fyi/live/brevo-trezor-subscriber-phishing-sep-2026/","json":"https://hard.fyi/api/live?id=brevo-trezor-subscriber-phishing-sep-2026"}