Trezor, a manufacturer of hardware bitcoin wallets, reported a security breach involving its third-party email service provider, Brevo. An unauthorized party gained access to the platform and sent phishing emails to 347,000 customers. The messages, which appeared to originate from Trezor's domain, contained malicious links prompting users to download an application and input their wallet backup phrases.
The company stated that it disabled the malicious domain at the DNS level within 20 minutes of discovery. According to Trezor, this action limited the number of users who clicked the link to 2,500 people. The firm emphasized that no internal systems were compromised during the incident and reiterated that it never requests wallet backup information from its customers.
This incident follows a series of recent data leaks affecting Trezor users. Last month, the company reported that information belonging to 11,742 customers was exposed through its fulfillment partner, ShipMonk. Subsequently, an additional 67,000 U.S. customers had their personal details, including names, phone numbers, and order history, leaked in a related breach.
The broader crypto sector has faced increased security challenges this year. Other industry participants, including Ledger and SafePal, have also reported data breaches involving third-party partners. In the case of SafePal, unauthorized access to order information affected approximately 39,798 customers, exposing personal details such as names and purchase data.
