Brevo SSO flaw let attacker send phishing to 347,000 Trezor newsletter addresses

An attacker abused Trezor’s account on third-party email platform Brevo to send a phishing message to roughly 347,000 addresses in the company’s opt-in newsletter database on 9 September 2026. Trezor reported that approximately 2,500 recipients clicked before the malicious domain was disabled within 20 minutes. A click alone does not establish that a wallet or funds were compromised.

The confirmed security incident occurred at Brevo and affected Trezor’s newsletter channel. Trezor says no company product, hardware wallet or account system was affected, a distinction that limits the incident’s established scope. The company also says the relevant Brevo environment contained no passwords or wallet data, although that claim has not been independently verified.

Trusted email infrastructure turned against recipients

The phishing email was framed as a critical security alert about an STM32 entropy vulnerability and directed recipients towards an application that requested their wallet backup. Because the attacker sent the message through compromised customer accounts on Brevo’s legitimate infrastructure, Brevo said it passed ordinary email authentication checks.

That trusted delivery path made the campaign different from phishing sent through an unrelated or obviously spoofed domain. The email reached subscribers through the same third-party platform Trezor used for genuine newsletter campaigns, allowing the attacker to misuse an established communication channel rather than compromise Trezor’s wallet technology.

Brevo’s later postmortem puts the provider-wide impact at 138 accessed client accounts. Six accounts were used to distribute phishing, contacts were exported from 43 accounts, and Brevo found no meaningful activity in 93. The provider did not describe those categories as mutually exclusive, so the available figures do not establish how the phishing and contact-export groups overlap.

Trezor’s incident notice, published on 10 September, cited an earlier figure of 120 affected Brevo accounts. Brevo’s subsequent total of 138 is the provider’s current figure. Neither company has identified the attacker, and the reviewed material contains no confirmed assessment of victim losses or the number of people who may have supplied a wallet backup.

SSO boundary failed between organisations

Brevo attributed the intrusion to an authorisation failure involving Security Assertion Markup Language single sign-on, commonly known as SAML SSO. Access authenticated through one organisation’s SSO configuration was not properly restricted to that organisation. As a result, the affected users could reach other organisations available to them and obtain unauthorised access to client accounts.

The flaw was exploited in this incident, as established by Brevo’s account findings and the messages sent from Trezor’s newsletter account. The public availability of any proof of concept is unknown. Brevo operates the affected marketing platform as a software service, and the incident notices did not identify an affected software version, a fixed version or a CVE.

Contact exfiltration is confirmed at the provider level, but not specifically for Trezor. Brevo found exports from 43 accounts, while Trezor says it cannot determine whether its own newsletter list was among them. It would therefore be inaccurate to describe all 347,000 Trezor newsletter addresses as a confirmed stolen database.

Trezor is nevertheless treating every address in that population as potentially known to the attacker and reusable in later phishing. That position is precautionary rather than confirmation of a Trezor-specific export. It also does not establish that every subscriber owns cryptocurrency, uses a Trezor device or suffered a compromise.

Immediate containment, permanent fix still unconfirmed

Trezor responded by taking down the malicious domain at the DNS level, disabling newsletter sending and suspending its Brevo account. It also placed warnings on its website, in Trezor Suite and across support and community channels, while directly notifying the newsletter population. Brevo said it identified the SAML SSO issue and unauthorised account access at 06:30 UTC on 10 September. It later disabled links in the phishing emails, reset all active platform sessions and closed the abused access route at 08:30 UTC.

Brevo says it observed no further attacker activity after closing that route, but this has not been independently verified. The provider also said it was deploying a permanent control intended to confine SAML SSO access to the organisation that owns each configuration. The reviewed notices do not confirm that this permanent change has been completed or independently validated, making the documented remediation status partial.

For recipients, Trezor’s guidance depends on what they did after opening the email. The company advises people to delete the message and avoid its links, downloads and requests for personal information. A click does not by itself demonstrate wallet compromise. According to Trezor, the material wallet risk arises when somebody entered their wallet backup into the malicious application.

Anyone who disclosed a wallet backup through the campaign should immediately move their funds to a newly created wallet, Trezor said. No confirmed figure is available for how many recipients entered that information, and neither Trezor nor Brevo has reported a verified amount of cryptocurrency lost through the campaign.

A second, separate third-party incident

The Brevo compromise follows a distinct incident involving Trezor’s shipping provider, ShipMonk. Trezor updated its notice about that breach on 4 September 2026 to report 80,689 affected customers and exposure involving shipping and contact information. The two incidents involved different providers and must not be treated as one compromise, but both placed customer information or communications outside Trezor’s direct infrastructure.

No reviewed source provided country-level figures, identified Australian victims or reported Australia-specific regulatory action. Other gaps include the full list of affected Brevo customers, the data fields exported from their accounts and whether Trezor’s account belonged to the group of 43 subject to contact exports.

The next material update will be whether Brevo confirms completion and validation of its permanent organisation-scoping control. Until then, Trezor-specific list exfiltration, resulting financial losses, the attacker’s identity and the geographical distribution of affected recipients all remain unresolved.

Ordinary email authentication could not establish that this message was trustworthy once a legitimate sending channel had been abused. Build context for that distinction with The Hack Academy’s online cybersecurity training programme, where self-paced learning and practical exercises sit alongside theory in listed subjects including networking, internet vulnerabilities and cybersecurity fundamentals.