The Brevo marketing platform was compromised through an SSO misconfiguration that allowed an attacker to access 138 accounts across multiple organizations. The attacker created a Brevo account, enabled SSO, and invited legitimate users, then used their own identity provider to sign in as those users. Due to improper scoping, the attacker gained access to all organizations accessible by those users, not just the intended single organization. The attacker sent phishing emails containing a malicious link to email addresses stored in six compromised accounts, including Trezor's, affecting roughly 347,000 users. The phishing emails warned of a 'Critical Security Alert: STM32 Entropy Vulnerability' and aimed to steal wallet backups. The malicious site was taken down within 20 minutes after detection. Additionally, contact data was exfiltrated from 43 accounts. BitBox and CoinTracking were also impacted, though details remain sparse. This incident compounds risks for Trezor users following a recent data breach at its shipping provider ShipMonk.

The phishing campaign targeted hundreds of thousands of cryptocurrency hardware wallet users, potentially exposing them to theft of wallet backups and loss of funds. Approximately 2,500 users clicked the malicious link before the site was taken offline, though the exact extent of financial loss is unknown. The breach also exposed contact data from multiple organizations, increasing the risk of further phishing or social engineering attacks. The incident undermines user trust in affected companies and highlights risks from third-party service compromises.

No official patch applies as this is a compromise of a third-party marketing platform and not a software vulnerability. Brevo has taken down the malicious website and addressed the SSO misconfiguration. Affected organizations should notify users promptly about the phishing campaign and advise them not to click suspicious links or enter wallet backups on untrusted sites. Users should verify communications through official channels and consider additional security measures such as hardware wallet PINs and passphrases. Monitoring for further phishing attempts is recommended. Since this is a third-party breach, remediation depends on Brevo and affected customers' response.