Trezor says third-party email incident exposed newsletter addresses and enabled phishing campaign

Trezor said a security incident at third-party email provider Brevo affected its marketing communications and exposed newsletter email addresses. The company’s September update said 347,149 contacts were exported through the provider API and that a phishing message was sent using the compromised channel. Trezor said its wallet systems and devices were not breached. The incident illustrates a recurring wallet-security problem: attackers do not always need to compromise cryptographic systems directly if they can abuse trusted communication channels to obtain recovery phrases through social engineering. For publishers and wallet providers alike, vendor security and clear incident communication are therefore part of the security perimeter. Avenor News reports the incident for security awareness and does not provide product recommendations.