Trezor: 347,000 Users Targeted in Phishing After Brevo Breach

Hardware cryptocurrency wallet provider Trezor disclosed on April 17, 2024, that 347,000 of its users were targeted in a sophisticated phishing campaign. This campaign originated from a data breach at Brevo, a customer relationship management (CRM) platform formerly known as Sendinblue, which Trezor utilizes for its email communications. The breach at Brevo exposed a significant volume of Trezor customer email addresses, which were subsequently used in the phishing attempts. While 347,000 email addresses were compromised and targeted, Trezor confirmed that approximately 2,500 users clicked on a malicious link embedded within the phishing emails. These emails were designed to impersonate Trezor, aiming to trick recipients into revealing sensitive information or compromising their device security. The phishing emails specifically prompted users to download a malicious firmware update for their Trezor hardware wallets. Trezor has emphasized that its hardware wallets themselves were not compromised, and the security of users' funds remains intact as long as they did not interact with the malicious link or download the fake firmware. The company has taken immediate steps to mitigate the impact, including revoking the malicious links and working with Brevo to understand the full scope of the breach. Trezor has also issued urgent advisories to its user base, urging them to be vigilant against further phishing attempts and to verify all communications directly through official Trezor channels. This incident highlights the growing threat of supply chain attacks, where a breach in a third-party service provider can have cascading effects on their clients' customers. Brevo, a widely used CRM platform, serves numerous businesses across various sectors, making such breaches a significant concern for data security. Trezor, a company dedicated to securing digital assets, is now facing the challenge of reassuring its users and reinforcing its security protocols in light of this external compromise. The company's response has focused on transparency and user education, providing clear instructions on how to identify and report suspicious activity. Users are advised to ignore any unsolicited emails requesting firmware updates and to always download software directly from the official Trezor website. The incident underscores the critical importance of robust security measures not only for direct service providers but also for their entire ecosystem of third-party vendors.