Brevo SSO Scope Flaw Leaks 347000 Trezor Emails for STM32 Phishing Campaign

Trezor disclosed that Brevo's marketing platform was compromised when an attacker created an account, enabled SSO, and invited legitimate users, bypassing intended organization boundaries. The flaw granted access to all organizations those users could reach rather than the single intended tenant. Trezor confirmed the attacker then exfiltrated contacts from 43 accounts and abused six to deliver the phishing messages. Only 2500 users clicked the link before the site was taken down within 20 minutes.

Evidence from Brevo's incident report and Trezor's customer notice shows the attack relied on expected SSO behavior combined with improper scoping, not a novel zero-day. Trezor had already suffered a separate ShipMonk shipping provider breach affecting 81000 customers in August, creating overlapping customer data exposure. BitBox and CoinTracking also used the same Brevo instance but have not published impact numbers.

The pattern reveals repeated third-party marketing and logistics dependencies in hardware wallet supply chains. Official statements from both firms describe the SSO issue as a configuration error without releasing logs or confirming whether the attacker retained access after remediation. Independent verification of fund losses remains absent.

Trezor customers should treat all prior wallet communications as potentially compromised and rotate any exposed seed phrases. Brevo has not stated whether other tenants received similar phishing volumes or whether the root SSO flaw has been fully patched across its platform.