Brevo has disclosed a security incident in which an attacker gained access to 138 customer accounts, using six of them to send phishing emails through legitimate Brevo infrastructure and exporting contact data from 43. Brevo says the remaining 93 accounts show no meaningful attacker activity, though the company’s own figures don’t quite reconcile: 6 plus 43 plus 93 comes to 142, four more than the stated total of 138, pointing to some overlap between the phishing and export groups that Brevo’s write-up doesn’t spell out.
According to that write-up, the attacker exploited a flaw in how Brevo handles SAML single sign-on. They created a Brevo account, enabled SSO using an identity provider they controlled, and invited legitimate Brevo users into that configuration. The problem came after authentication: access wasn’t properly scoped to the organisation where SSO had been set up, so the attacker could reach every other organisation those invited users already had access to.
Phishing sent through legitimate infrastructure
For email professionals, the important detail is how the phishing was delivered. Brevo says the messages went out through legitimate infrastructure, so they passed the usual authentication checks and looked genuine. This wasn’t spoofing, or a way round SPF, DKIM or DMARC. The attacker had access to infrastructure that was already authorised to send. Authentication confirms a message came from that infrastructure; it says nothing about whether the person using it should have access to it at all.
Trezor and CoinTracking among those affected
Hardware wallet maker Trezor confirmed its Brevo account was one of those hit. A phishing email headed “Critical Security Alert: STM32 Entropy Vulnerability” went out to Trezor’s opt-in newsletter list of 347,149 addresses, directing recipients to a fake app that asked for their wallet backup. Trezor says it pulled the domain at DNS level within 20 minutes, by which point around 2,500 people had clicked the link, and that no Trezor product, wallet or account system was touched. Trezor’s own post puts the number of affected Brevo accounts at 120, against Brevo’s official figure of 138. Worth noting if you’re cross-referencing the two: they don’t match.
CoinTracking confirmed a similar email, “Data Breach Notice: Please refresh API Keys as soon as possible,” went out through the same provider. It said its own systems, passwords, API keys and portfolio data were unaffected.
Brevo says it identified the issue at 06:30 UTC on 10 September and closed the route two hours later, resetting all active sessions. It reports no further attacker activity since, and is deploying a permanent fix that restricts SSO access strictly to the organisation that owns the configuration.
The incident is a clean case study for the deliverability world: authenticated email isn’t automatically safe email. When an attacker controls legitimate sending infrastructure, every trust signal built to catch spoofing stays intact.
