Observed Signal · Sep 11, 2026 · Data Breach · Source: techcrunch · Impact: 3/5 · Sentiment: Negative
Trezor warns of phishing after Brevo email provider breach
Hardware crypto wallet maker Trezor has warned customers of a second data breach affecting its ecosystem in as many months. A cyberattack on Brevo, a marketing technology company used by Trezor for email newsletters, allowed hackers to send approximately 347,000 phishing emails to Trezor customers. The phishing emails contained a malicious link that, when clicked, downloaded an app requesting the victim's wallet backup password, which could be used to steal cryptocurrency funds irreversibly. Brevo reported that hackers accessed 138 accounts due to improperly scoped permissions. Trezor emphasized that its own products and account systems were not compromised. This incident follows a previous breach at shipping partner ShipMonk that exposed personal data of over 81,000 customers, heightening risks of targeted physical attacks. Trezor is reevaluating vendor relationships and warns that email addresses may be used for future phishing attempts.
The data breach at Trezor highlights systemic vulnerability in AdTech/MarTech supply chains, affecting a significant number of cryptocurrency holders and underscoring risks for marketing technology providers.
Track Brevo Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Cyberattack on Brevo allowed hackers to send approximately 347,000 phishing emails to Trezor customers.
- Brevo reported that hackers accessed 138 accounts due to improperly scoped access permissions.
- Phishing emails contained a malicious link that could be used to steal wallet backup passwords.
- Trezor confirmed that its own products, wallets, and account systems were not affected.
- This is the second data breach affecting Trezor customers within two months; the first involved shipping partner ShipMonk, exposing data of at least 81,000 people.
Connected Companies & Entities
1 Entity mapped“A cyberattack on Brevo, a marketing tech company that Trezor uses to send newsletters, allowed hackers to send around 347,000 phishing email...”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Ledger Investigates Tampered Wallets via Reseller CryptoBilis
Ledger, the French hardware wallet manufacturer, has confirmed that a customer's device contained an unauthorized hardware implant, following a series of thefts in Southeast Asia. The affected devices were sold through CryptoBilis, an official Ledger distributor for Indonesia, Malaysia, and the Philippines. The implant, reportedly a second circuit board with a microcontroller and cellular hardware, can intercept recovery phrases during setup and transmit them remotely. Blockchain analytics firms estimate losses between $71.5 million and $92.9 million across hundreds of wallets on Bitcoin, Ethereum, and Tron. Ledger has demanded CryptoBilis halt all sales and deliveries, advising customers who purchased in the last 90 days to transfer funds to new devices with fresh recovery phrases. Ledger states its own infrastructure was not compromised and is reviewing reseller controls. CryptoBilis has suspended all hardware wallet sales pending investigation. The incident adds to Ledger's history of security issues, including a 2020 data leak and a 2023 Connect-Kit attack.
Keystone and Foundation Hardware Wallets Hacked
Hardware wallet makers Foundation and Keystone have both suffered data breaches, compromising customer data but not directly stealing cryptocurrencies. At Foundation, attackers exploited compromised Cloudflare API keys to send phishing emails from the company's own domains, potentially exposing customer mailing addresses and phone numbers. At Keystone, a flaw in a third-party monitoring tool allowed attackers to access nearly 26,000 customer records from 2024-2026, including names, contact details, and order information. Keystone is destroying over 18,800 wallets because the device verification key was also compromised. Both companies confirm that devices, payment data, seed phrases, and private keys remain safe. These incidents are part of a year marked by hardware wallet security issues, with Ledger and Coldcard also facing breaches. The primary risk is phishing, as attackers can use stolen personal data to craft convincing emails.
Tenga: Hacker Stole Customer Information
Japanese sex-toys maker Tenga notified customers that an unauthorized party accessed a professional email account of one of its employees, exposing the inbox contents and potentially customer names, email addresses and historical correspondence — which may include order details or customer-service inquiries. TechCrunch obtained the notification email, which said the intruder also sent spam to the compromised account’s contacts. A forensic review communicated to TechCrunch found the breach affected approximately 600 people in the United States; it is unclear whether customers outside the U.S. were impacted. Tenga said it reset the employee’s credentials and enabled multi-factor authentication across its systems, and recommended customers change passwords and watch for suspicious emails. The company noted it has shipped over 162 million products worldwide. The report was first published Feb. 13 and updated with a Tenga spokesperson’s comment.
Receive all future signals for Brevo & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.