Trezor said attackers breached its third-party email provider and sent customers a phishing message disguised as a critical "STM32 Entropy Vulnerability" alert. The incident marked the company’s third vendor failure in four weeks. Trezor took down the campaign’s domain and is investigating how the attackers accessed its legitimate domain, while saying wallets, keys and recovery backups were not exposed. The broader sequence began with an August 10 breach at ShipMonk, which ships Trezor orders; a September 4 update said more than 80,000 customers were affected, exposing names, phone numbers and home addresses. Customers have since reported scam calls and printed letters. Trezor previously warned 66,000 users after a 2024 support portal breach, while SafePal reported nearly 40,000 leaked records last month. BitBox also reported phishing sent to newsletter subscribers and said attacks may have targeted Bitcoin companies using the same newsletter provider.