A breach at email service provider Brevo let attackers send phishing emails that appeared to come from legitimate cryptocurrency companies, putting customers at immediate risk of account compromise and theft. Trezor, BitBox, and CoinTracking said their newsletter subscribers received malicious emails from real company domains; Brevo said an attacker accessed 120 customer accounts and used them to send phishing messages. The lures included fake security alerts and bogus breach notices directing users to lookalike phishing sites.
Why it matters: People who trust these brands may hand over wallet, exchange, or account credentials because the emails came from legitimate domains. Affected users should avoid all recent security-alert emails from these companies, verify messages through official sites, and rotate credentials or API keys if they clicked or submitted data.
Eduard Kovacs
2026.09.11
97% relevant
This source directly updates the Brevo breach story with Trezor’s impact figures: about 347,000 recipients received the phishing email, roughly 2,500 clicked the link, the lure used the subject 'Critical Security Alert: STM32 Entropy Vulnerability,' and Brevo says the intrusion abused a SAML SSO scoping flaw affecting 138 accounts, with contacts exfiltrated from 43.
Sergiu Gatlan
2026.09.11
98% relevant
This article directly updates the Brevo breach story with Trezor-specific impact details: 347,000 newsletter email addresses were targeted, about 2,500 users clicked the malicious link before takedown, and the phishing lure falsely claimed a Trezor hardware microcontroller flaw to trick users into entering wallet backups.
2026.09.10
100% relevant
This article establishes a distinct breach event at Brevo that directly enabled phishing against multiple cryptocurrency companies' customers.
← Back to all stories