Trezor has disclosed that a data breach at Brevo, its third-party email marketing platform, has led to phishing attacks targeting 347,000 of its customers. An unauthorized actor accessed Brevo's system and used Trezor's domain name to send fraudulent emails, increasing the credibility of the scam.
The phishing email, titled "Critical Security Alert: STM32 Entropy Vulnerability," contained a malicious link requesting users to download an app and provide their wallet backup credentials. Trezor stated it disabled the malicious domain within 20 minutes at the DNS level, limiting exposure to approximately 2,500 users who clicked the link before removal.
"No other Trezor system was touched," the company said, adding that it has suspended the Brevo account to prevent further email distribution. Trezor reminded users that the company never requests wallet backups from customers.
This breach represents the third security incident for Trezor in recent weeks. Last month, the company announced that its fulfillment partner ShipMonk had been compromised, exposing data from 11,742 customers. An additional disclosure followed, revealing that 67,000 U.S. customers had their names, emails, phone numbers, shipping addresses, and order numbers leaked in the same breach.
The incidents reflect broader targeting of cryptocurrency wallet providers this year. Ledger users previously faced phishing campaigns after its payment processor Global-e was breached, and SafePal disclosed unauthorized access to approximately 39,798 customers' order information and personal details.
