Privacy Market: Trezor warns of phishing after Brevo email provider breach

Hardware crypto wallet maker Trezor has warned customers of a second data breach affecting its ecosystem in as many months. A cyberattack on Brevo, a marketing technology company used by Trezor for email newsletters, allowed hackers to send approximately 347,000 phishing emails to Trezor customers. The phishing emails contained a malicious link that, when clicked, downloaded an app requesting the victim's wallet backup password, which could be used to steal cryptocurrency funds irreversibly. Brevo reported that hackers accessed 138 accounts due to improperly scoped permissions. Trezor emphasized that its own products and account systems were not compromised. This incident follows a previous breach at shipping partner ShipMonk that exposed personal data of over 81,000 customers, heightening risks of targeted physical attacks. Trezor is reevaluating vendor relationships and warns that email addresses may be used for future phishing attempts.