Brevo said a security incident on September 10 compromised 138 customer accounts after an attacker exploited a vulnerability in its SSO SAML management, with some of the affected accounts later used to send phishing emails that reached customers of CoinTracking, Trezor, and BitBox.

According to Brevo, the attacker gained access through a vulnerability in SSO SAML management. The company said 138 customer accounts were compromised, six of which were used to send phishing emails. It also said the contacts of 43 accounts were exported.

Brevo said it would directly contact affected customers with specific information. The company also said it had blocked the entry point used in the attack. Even so, phishing campaigns had already been detected after the breach.

Among the named crypto-related targets, CoinTracking warned users about a fraudulent email carrying the subject line “Data Breach Notice: Please refresh API Keys as soon as possible.” The original notice also said customers of hardware wallet brands Trezor and BitBox were being targeted, and that other crypto projects could also be affected.

The incident appears to be an indirect compromise of customer communications rather than a direct exploit of crypto infrastructure or on-chain systems. The disclosed details do not show direct theft of user funds, but they do point to ongoing risks tied to fake security notices, urgency-driven messages, and requests for sensitive data.

Why It Matters

This case underscores how third-party software providers can become a distribution channel for attacks across the crypto sector. Even when a breach does not hit a blockchain, exchange, or wallet system directly, compromised email infrastructure can still create credible phishing lures that exploit user trust in familiar brands.

It also puts pressure on crypto companies to tighten incident-response procedures around user communications. In security events, the distinction between a real remediation notice and a fake one can determine whether an operational breach turns into a broader ecosystem trust problem.