Trezor Says Brevo Marketing Tool Breach Enabled Phishing Campaign Against 347,000 Customers

ChainCatcher reported that Trezor, the maker of Bitcoin hardware wallets, warned customers of a breach involving Brevo, a third-party marketing platform it uses to distribute newsletters. The incident allowed attackers to send phishing emails to 347,000 Trezor customers. Trezor said the attackers leveraged a Trezor domain to make the messages appear legitimate. The emails included malicious links aimed at prompting recipients to download apps and submit wallet backups. The company said it disabled the affected domain at the DNS level within 20 minutes, cutting off access to the phishing links. About 2,500 users had already clicked the links before access was blocked. Trezor added that it has suspended its Brevo account to stop further email distribution and stressed that no other Trezor systems were impacted. Trezor reiterated that it never asks customers to provide their wallet backups. The disclosure follows earlier third-party incidents. Last month, Trezor said its fulfillment partner ShipMonk was compromised, exposing data tied to 11,742 customers. Last week, it reported that personal information for another 67,000 U.S. customers was exposed, including names, email addresses, phone numbers, shipping addresses, and order numbers. Separately, earlier this year payment processor Globale, used by crypto wallet maker Ledger, and wallet provider SafePal also reported breaches. SafePal said unauthorized parties accessed order information for about 39,800 customers.