On September 9, 2026, Brevo, a third-party email marketing platform used by Trezor, suffered a security breach affecting 120 Brevo accounts, including Trezor's. Threat actors used this access to send phishing emails to approximately 347,000 Trezor newsletter subscribers. The phishing emails falsely warned of a hardware microcontroller vulnerability in Trezor wallets and included malicious links prompting users to download an app to capture wallet backup seeds. About 2,500 users clicked the malicious links before Trezor took down the phishing domain within 20 minutes. Trezor suspended its Brevo account to prevent further email distribution. No other Trezor systems were compromised. This incident follows earlier breaches involving Trezor's support ticketing portal and logistics provider, ShipMonk.

The breach exposed the email addresses of approximately 347,000 Trezor newsletter subscribers, enabling targeted phishing attacks. About 2,500 users clicked on malicious links, potentially exposing their wallet backup seeds to theft. However, Trezor's core systems were not compromised, and the phishing domain was taken down quickly, limiting further impact. The exposed email addresses may be used in future phishing attempts. Previous breaches have also exposed customer personal data, increasing overall risk to Trezor users.

Trezor has suspended its Brevo account to stop further phishing email distribution and took down the malicious phishing domain within 20 minutes of detection. Users are advised to remain vigilant against phishing attempts and avoid clicking suspicious links or downloading unverified apps. Since no Trezor systems were compromised, no direct action on Trezor wallets is required beyond standard phishing awareness. Monitor official Trezor communications for updates.