Brevo Login Flaw Enabled Phishing Email to 347K Trezor Subscribers

The exposure sits with a third-party vendor, not the wallet itself, which is the recurring lesson for hardware makers that outsource customer communications: the attack surface extends to every processor holding a mailing list. Treating all affected addresses as compromised is the prudent posture, but it also signals that Brevo's access controls failed at a layer Trezor cannot audit. The open question is whether this remains a phishing-only incident or points to a broader vendor-security problem across the sector.