Trezor: 347,000 users targeted in phishing attacks after Brevo breach September 11, 2026 Trezor has revealed that phishing attacks against its customers earlier this week targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link. As Trezor warned on Wednesday , threat actors who breached Brevo , its third-party email provider, were emailing customers who opted in to receive newsletters. According to customers targeted in this phishing campaign, they received fake "critical security alert" emails from help@trezor.io claiming that a "hardware microcontroller vulnerability" in Trezor cold storage wallets' STM32 microcontrollers could expose their seeds to brute-force cracking. The phishing emails tried to trick recipients into clicking a malicious link that prompted them to download an app that asked them to enter their wallet backup. Trezor says that it took down the domain used in the phishing attacks within 20 minutes, disabling the link and limiting the campaign's impact to 2,500 customers who had clicked it before it was taken down. "On September 9, 2026, Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts. An unauthorized actor gained access to Brevo's system and used it to send emails from various customer accounts, including Trezor's," the company said . "The incident affected our opt-in newsletter database, roughly 347,000 email addresses. These addresses might be potentially used for other phishing attacks in the future. No other Trezor system was touched. We have suspended the Brevo account to stop further email distribution." In January 2024, Trezor disclosed another data breach after its third-party support ticketing portal was hacked and attackers stole data (including names, usernames, and email addresses) from roughly 66,000 users. Trezor also disclosed a data breach last month after threat actors hacked ShipMonk, its logistics and shipping provider, using a critical Metabase SQL injection zero-day vulnerability , and stole customers' order data, including full names, shipping addresses, email addresses, and phone numbers. While Trezor initially said the incident affected nearly 14,000 customers , a follow-up investigation found that the resulting breach affected an additional 67,000 U.S. customers , bringing the total to 81,000 individuals. The company said that the incident also affected customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026. Since then, BleepingComputer also learned that ShipMonk received extortion emails from the ShinyHunters extortion gang following the breach. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Trezor warns users of email provider breach, phishing attacks Passkey-themed phishing attacks lead to Microsoft 365 data theft How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface

The Top 4 Threats We Found by Investigating Every Alert for a Quarter Man gets six years for hacking 750 women's Snapchat accounts Previous Article Not a member yet? Register Now You may also like: September Windows Server updates break Remote Desktop Services September Windows Server updates break Remote Desktop Services Microsoft Excel KB5002914 update breaks copy and paste for some users Microsoft Excel KB5002914 update breaks copy and paste for some users New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Overdue a password health-check? Audit your Active Directory for free Overdue a password health-check? Audit your Active Directory for free EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain