Solana Mobile has issued a security warning to its users following a data breach at Brevo, an email service provider. Attackers exploited a vulnerability in the SAML SSO authentication mechanism between September 9 and September 10, 2026, gaining unauthorized access to 138 customer accounts.
The breach allowed malicious actors to export contact data, which was subsequently used to launch phishing campaigns targeting hundreds of thousands of individuals in the crypto sector. These emails impersonated trusted brands to solicit credentials or direct users to malicious links.
Brevo identified the intrusion and closed the security gap by 8:30 AM UTC on September 10, 2026, by resetting all active sessions. Solana Mobile confirmed that its own internal accounts were not among the 138 compromised, but issued the alert to protect users from potential fraud.
The incident highlights the risks associated with third-party vendors and authentication infrastructure. Security experts emphasize that legitimate companies will never request seed phrases via email, and businesses must conduct rigorous due diligence on the security posture of their service providers.
