Brevo breach enabled wallet-backup phishing against 347,000 Trezor subscribers
Attackers used Trezor’s email provider to send wallet-backup phishing to about 347,000 subscribers. Delete the message. If you disclosed your backup, immediately move your funds to a new wallet.
Delete the fraudulent security email and never provide your wallet backup through an email link or downloaded app. If you entered your backup, follow Trezor’s official guidance and immediately move your funds to a new wallet. Check future warnings directly on Trezor’s website or in Trezor Suite.
What’s happening
Attackers breached Brevo, Trezor’s newsletter provider, and sent subscribers a fake hardware-security warning designed to obtain their wallet backups. Brevo’s single sign-on handling allowed access beyond the intended organisation. Its investigation counted 138 accessed accounts, six used for phishing and 43 with exported contacts; Trezor’s statement still quotes the earlier total of 120. Brevo blocked access on 10 September and marked the incident resolved, although its write-up described the permanent single sign-on fix as still being deployed. Trezor notified recipients and disabled the phishing link. On 17 September it confirmed that 347,149 subscriber email addresses had been exported. Trezor said its products, wallets and account systems were unaffected. As of 3 November, the reviewed sources disclose no confirmed financial-loss total or recovery outcome. The stolen addresses remain a risk for further phishing; there is no device update that reverses their exposure.
- What
- Scam
- Affects
- Trezor newsletter subscribers and Brevo customer accounts
- Fixed in
- Nothing to patch
- Since
- 9 Sept 2026
- Closed
- 17 Sept 2026
Timeline
- Vendor revised
Trezor confirmed that 347,149 newsletter email addresses had been exported, leaving subscribers exposed to further targeted phishing.
- Update
Brevo blocked the access route and signed out all users. Its write-up said attacker access had ended, while a permanent fix to restrict single sign-on access to the correct organisation was being deployed.
- Update
Brevo detected abuse of its single sign-on handling. It confirmed access to 138 customer accounts, phishing sent from six accounts and contact exports from 43.
- Update
Brevo marked the account-access incident resolved and said affected services were operating normally.
- Made public
Trezor said it had notified all recipients and disabled email sending. It reported disabling the phishing link within 20 minutes, after approximately 2,500 people had clicked.
- UpdateNothing to patch
According to Trezor, attackers used its Brevo newsletter account to send approximately 347,000 subscribers a fraudulent security warning. It directed recipients to an app that requested their wallet backup.
Sources
- Attacker gained access to client accounts — write-upBrevo · 10 Sept 2026
- Security incident at Brevo, our third-party email providerTrezor · 17 Sept 2026
- Attacker gained access to client accounts — resolvedBrevo · 10 Sept 2026
- Trezor Says 347,000 Users Received Phishing Emails After Brevo HackSecurityWeek · 11 Sept 2026
- Crypto customers targeted by scammers after email marketing provider breachMalwarebytes · 11 Sept 2026