Trezor's blog (10 September 2026) says that on 9 September 2026 Brevo, the third-party marketing platform Trezor uses for newsletter campaigns, suffered a security incident affecting 120 Brevo accounts, and an unauthorised actor used Brevo's system to send emails from various customer accounts, including Trezor's.

Trezor says the incident affected its opt-in newsletter database of roughly 347,000 email addresses, that no other Trezor system was touched, and that it suspended the Brevo account. The phishing email, subject “Critical Security Alert: STM32 Entropy Vulnerability”, contained a link that prompted users to download an app asking for their wallet backup.

Trezor says it took the domain down at the DNS level within 20 minutes, limiting access to 2,500 people who had clicked before the takedown, and contacted all 347,000 recipients.

According to BleepingComputer (11 September 2026), the fake alerts came from help@trezor.io and claimed that a “hardware microcontroller vulnerability” in the STM32 microcontrollers used in Trezor wallets could expose seeds to brute-force cracking. Trezor's advice: anyone who entered a wallet backup through such a link should immediately move their funds to a new wallet; Trezor will never ask for a wallet backup. This is a different incident from Brevo's 14 September Cloudflare Worker ClickFix compromise (separate desk card).

Primary: Trezor blog. Updated 17 Sep 2026: Trezor's post now says Brevo confirmed that 347,149 marketing email contacts were exported from Trezor's list through the API during the incident. (source: Trezor blog, trezor.io)