Trezor said a Brevo authorization failure enabled attackers to send phishing emails impersonating the hardware-wallet maker to roughly 347,000 newsletter subscribers and directing recipients to a malicious application seeking wallet backups. Brevo said an attacker accessed 138 customer accounts by exploiting a single sign-on permissions flaw; six accounts sent phishing messages, contacts were exported from 43, and 93 showed no meaningful activity. The compromised accounts included Trezor, BitBox and CoinTracking. Trezor said its wallets, wallet backups and internal systems were not compromised, but is treating its full newsletter list as potentially known to the attacker. The incident follows a separate ShipMonk data exposure involving at least 81,000 Trezor purchasers.