Brevo login flaw hit Trezor newsletter subscribers

An attacker exploited a weakness in Brevo’s login process to gain access to client accounts and send phishing emails through the platform. The campaign reached about 347,000 subscribers tied to Trezor, while similar messages were also sent from accounts associated with BitBox and CoinTracking.

How the breach worked

Brevo said the attacker first created an account, turned on single sign-on and then invited legitimate Brevo users into that setup. The company said access was supposed to stay limited to that organization, but a failure in the authorization flow allowed the intruder to move further into the system. The result was access to 138 client accounts.

Brevo’s postmortem said six accounts were used to send phishing emails, while contacts were exported from 43 accounts and 93 accounts showed no meaningful activity. The company did not say whether those groups overlapped. That leaves the full scope of the exposure unclear, even though the incident was broad enough to affect several crypto-related businesses.

Impact on Trezor and users

Trezor said the phishing message reached 347,000 newsletter subscribers and that it is treating each address as known to the attacker and potentially reusable for further phishing. That raises the risk that the incident could extend beyond the single email campaign if the stolen data is reused in later attacks.

The hardware wallet maker was not the only affected name. Brevo said the same breach also enabled fraudulent emails linked to BitBox and CoinTracking, showing that the issue spread across multiple customer accounts rather than staying confined to one brand. For users, the main concern is that a trusted mailing channel was abused to deliver the lure.

The episode underlines how attackers can turn business software into a distribution tool for scams. Rather than breaking into end-user wallets directly, the intruder exploited a login and account-authorization weakness at a service provider, then used that access to impersonate familiar brands and reach large mailing lists.

Trezor’s warning means subscribers should be cautious with any message that appears to come from the company, especially if it asks for credentials or pushes urgent action. The incident also adds to pressure on email and customer-relationship platforms to harden account controls, since one breach at the infrastructure layer can quickly spill over to many clients.

This article is not investment advice and recommends no asset, level or direction; a single session's move is not evidence of a trend. For background see Crypto, Altcoin, Bitcoin, and for terms the finance glossary.