Reported by 2 outlets

Timeline

1. original reporting

   Trezor: 347,000 users targeted in phishing attacks after Brevo breach https:// bleepingcomputer.com/news/security/ trezor-347-000-users-targ

   www.bleepingcomputer.com · 32d ago · September 11th, 2026

   Trezor: 347,000 users targeted in phishing attacks after Brevo breach https:// bleepingcomputer.com/news/security/ trezor-347-000-users-targ

   via X https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/

2. original reporting

   Trezor: 347,000 users targeted in phishing attacks after Brevo breach Indicators extracted from public reporting. Source: https:// trezor.io

   trezor.io · 32d ago · September 11th, 2026

   Trezor: 347,000 users targeted in phishing attacks after Brevo breach Indicators extracted from public reporting. Source: https:// trezor.io

   via Mastodon https://trezor.io/blog/news/security-incident-at-brevo-our-third-party-email-provider

3. update from bleepingcomputer.com

   Trezor: 347,000 users targeted in phishing attacks after Brevo breach

   bleepingcomputer.com · 32d ago · September 11th, 2026

   Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. As Trezor warned on Wednesday , threat actors who breached Brevo , its third-party email provider, were emailing customers who opted in to receive newsletters. According to customers targeted in this phishing campaign, they received fake "critical security alert" emails from help@trezor.io claiming that a "hardware microcontroller vulnerability" in Trezor cold storage wallets' STM32 microcontrollers could expose their seeds to brute-force cracking. The phishing emails tried to trick recipients into clicking a malicious link that prompted them to download an app that asked them to enter their wallet backup. Trezor says that it took down the domain used in the phishing attacks within 20 minutes, disabling the link and limiting the campaign's impact to 2,500 customers who had clicked it before it was taken down. "On September 9, 2026, Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts. An unauthorized actor gained access to Brevo's system and used it to send emails from various customer accounts, including Trezor's," the company said . These addresses might be potentially used for other phishing attacks in the future. No other Tre