Reported by 6 outlets
Trezor Warns of Phishing Attack Following Data Breach at Email Marketing Provider 📰 Original title: Scammers target hundreds of thousands of
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.42 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The incident is not a product vulnerability but a supply-chain compromise of Brevo, the third-party email marketing platform Trezor uses for newsletter campaigns. Attackers exploited a SAML SSO scoping flaw in Brevo to access 138 customer accounts, then used Trezor's legitimate domain to send phishing emails to roughly 347,000 newsletter subscribers with the subject line "Critical Security Alert: STM32 Entropy Vulnerability" and the sender address help@trezor.io. The message claimed a fake hardware-level vulnerability in STM32 microcontrollers could expose seed phrases to brute-force cracking, and it directed recipients to a malicious link. Trezor suspended the Brevo account, took the domain down at the DNS level within 20 minutes, and stated that about 2,500 people had clicked the link before it was disabled. No Trezor wallet or account system was breached.
A successful attack on this campaign means direct theft of cryptocurrency: any user who entered a wallet backup through the linked application surrendered their seed phrase. That makes this story materially different from routine software vulnerability news because the exposure is not theoretical; it is a targeted, domain-authenticated phishing operation against self-custody users who hold high-value assets offline. The 347,000 subscriber count represents a massive pool of potential victims, and the timing compounds the risk because it follows the August ShipMonk breach that exposed order data for 81,000 customers across the U.S., Brazil, Colombia, and Italy. That earlier breach gave attackers names, addresses, emails, and phone numbers, giving the Brevo phishing campaign richer context to craft convincing messages.
Defenders should treat any email referencing "STM32 Entropy Vulnerability" or asking for wallet backups as malicious and delete it immediately. Trezor has confirmed it will never ask for a wallet backup by email. Users who clicked the link and entered any recovery phrase must move funds to a new wallet immediately. On the network side, the malicious domain used in the campaign has been disabled by Trezor, but defenders should still hunt for references to the domain in proxy and DNS logs. Monitor for additional phishing attempts that leverage the 43 Brevo accounts from which contacts were exported, since those lists could fuel secondary campaigns. There are no product patches to apply; the remediation is vendor-side suspension of Brevo and user-side awareness.
Watch for Brevo's full postmortem confirming the full scope of the 138 compromised accounts and any new weaponized accounts. Also monitor whether attackers deploy additional supply-chain campaigns through the 43 accounts that exported contact lists, since those lists include cryptocurrency subscribers beyond Trezor who could receive similar domain-authenticated phishing emails in the coming weeks.
Timeline
-
original reporting
Trezor Warns of Phishing Attack Following Data Breach at Email Marketing Provider 📰 Original title: Scammers target hundreds of thousands of
en.killbait.com · 32d ago · September 11th, 2026
Trezor Warns of Phishing Attack Following Data Breach at Email Marketing Provider 📰 Original title: Scammers target hundreds of thousands of
via Mastodon https://en.killbait.com/trezor-warns-of-phishing-attack-following-data-breach-at-email-marketing-provider.html?utm_source=mastodon_social&utm_medium=social&utm_campaign=killbait.mastodon_social
-
update from x.com
Trezor vendor disclosure on X (original disclosure before first_seen)
x.com · 34d ago · September 9th, 2026
Trezor posted on X at 8:37 PM on September 9, 2026: the third-party email provider had been breached, and a phishing email named 'Critical Security Alert: STM32 Entropy Vulnerability' was not from Trezor. The company warned users not to click any links, stated the malicious domain had been taken down, and confirmed it was investigating how attackers accessed the legitimate domain.
-
update from thecybersecguru.com
🚨 Brevo breach linked to a targeted crypto phishing campaign. Trezor, BitBox & CoinTracking users received convincing “Critical Security Ale
thecybersecguru.com · 34d ago · September 10th, 2026
🚨 Brevo breach linked to a targeted crypto phishing campaign. Trezor, BitBox & CoinTracking users received convincing “Critical Security Ale
via Mastodon https://thecybersecguru.com/news/trezor-bitbox-cointracking-brevo-phishing-attack/
-
update from bleepingcomputer.com
Trezor warns users of email provider breach, phishing attacks
bleepingcomputer.com · 33d ago · September 10th, 2026
Cryptocurrency hardware wallet maker Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. Affected customers received fake "critical security alert" emails from help@trezor.io claiming that a "hardware microcontroller vulnerability" in the STM32 microcontrollers used by Trezor cold storage wallets could expose their seeds to brute-force cracking. "Our third-party e-mail provider has been breached. "We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain." Trezor phishing email ( Geo Soul ) ​Trezor also disclosed a data breach in August after attackers hacked ShipMonk, its shipping and logistics provider, and stole customers' order data, including full names, shipping addresses, email addresses, and phone numbers. While the company initially said the incident affected nearly 14,000 customers , a Friday update warned that a follow-up investigation found the breach affected an additional 67,000 U.S. customers , bringing the total to 81,000. As Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy,
-
mentioned by www.bleepingcomputer.com
Trezor warns users of email provider breach, phishing attacks https:// bleepingcomputer.com/news/security/ trezor-warns-users-of-email-provi
www.bleepingcomputer.com · 33d ago · September 10th, 2026
-
update from www.bleepingcomputer.com
Trezor warns users of email provider breach, phishing attacks Indicators extracted from public reporting. Source: https://www. bleepingcompu
www.bleepingcomputer.com · 33d ago · September 10th, 2026
Trezor warns users of email provider breach, phishing attacks Indicators extracted from public reporting. Source: https://www.
-
mentioned by techcrunch.com
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider This is the second data breach af
techcrunch.com · 32d ago · September 11th, 2026
-
mentioned by justpaste.in
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider This is the second data breach af
justpaste.in · 20d ago · September 23rd, 2026
-
mentioned by justpaste.in
Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider This is the second data breach af
justpaste.in · 14d ago · September 29th, 2026