According to CoinMeta, users of the Trezor hardware wallet suffered phishing attacks due to an authorization vulnerability in the Brevo login system. The attackers exploited the Brevo single sign-on system to access 138 customer accounts and sent phishing emails through these accounts. In a post-incident analysis on Thursday, Brevo stated that the attackers created a Brevo account and enabled single sign-on, then invited legitimate users to join the organization they controlled. As a result of this incident, 6 accounts were used to send phishing emails, and the contacts of 43 accounts were exported. Trezor mentioned that their Brevo account contained the email addresses of approximately 347,000 subscribers, with no other customer information stored. The company has notified all subscribers and took the malicious domain offline within 20 minutes.