[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzrDFoDjfOGSA-gCNn20J1FeVM6BxHYqTYRDeM_g6mhQ":3},{"article":4,"iocs":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":33,"category":34,"article_tags":38},"1ef8e347-6a0e-4b07-b00f-60ffa99fa3bb","Trezor warns users of email provider breach, phishing attacks","trezor-warns-users-of-email-provider-breach-phishing-attacks-06d5e9","Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. [...]","Hardware wallet maker Trezor is alerting customers to phishing attacks originating from a breach of its third-party email provider. Threat actors are sending fake security alerts to trick users into clicking malicious links. This follows a previous data breach at Trezor's shipping provider, ShipMonk, which exposed personal information of over 81,000 customers.","Trezor warns users of phishing attacks after its email provider and shipping partner were breached.","Trezor warns users of email provider breach, phishing attacks By Sergiu Gatlan September 10, 2026 02:56 AM 0 Cryptocurrency hardware wallet maker Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. Affected customers received fake \"critical security alert\" emails from help@trezor.io claiming that a \"hardware microcontroller vulnerability\" in the STM32 microcontrollers used by Trezor cold storage wallets could expose their seeds to brute-force cracking. The company said that it's investigating the breach and that the domain has been taken down to stop the attacks. \"Our third-party e-mail provider has been breached. Please be aware that the email named 'Critical Security Alert: STM32 Entropy Vulnerability' is not coming from us, and it's a phishing attempt. Do not click on any link,\" Trezor warned. \"We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.\" Trezor phishing email (Geo Soul) ​Trezor also disclosed a data breach in August after attackers hacked ShipMonk, its shipping and logistics provider, and stole customers' order data, including full names, shipping addresses, email addresses, and phone numbers. While the company initially said the incident affected nearly 14,000 customers, a Friday update warned that a follow-up investigation found the breach affected an additional 67,000 U.S. customers, bringing the total to 81,000. As Trezor explained, the data breach also impacted customers in Brazil, Colombia, Italy, Portugal, Sweden, and the United Kingdom who received orders between May 10 and August 8, 2026. While it didn't say how ShipMonk's systems were breached, breach notification emails seen by BleepingComputer said the attackers exploited a vulnerability in the Metabase analytics platform. In early August, Metabase said the threat actors exploited a critical SQL injection zero-day vulnerability to breach customer instances, gain administrator access, and steal data. BleepingComputer has also learned that ShipMonk received extortion emails from the ShinyHunters extortion gang after the breach. In January 2024, Trezor disclosed another data breach after its third-party support ticketing portal was compromised and the attackers accessed data (e.g., names, usernames, and email addresses) from roughly 66,000 users. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: How MSPs can catch phishing attacks email filters missMan gets six years for hacking 750 women's Snapchat accountsShinyHunters extortion gang claims Odido breach affecting millionsBigBear Microsoft 365 phishing service bypassed MFA at 258 organizationsTrezor discloses data breach affecting nearly 14,000 customers","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ftrezor-warns-users-of-email-provider-breach-phishing-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F07\u002FTrezor.jpg","2026-09-10T06:56:33+00:00","2026-09-10T08:00:10.664108+00:00",8,[18,21,23,25,28,30],{"name":19,"type":20},"STM32 microcontrollers","product",{"name":22,"type":20},"Metabase",{"name":24,"type":20},"cold storage wallets",{"name":26,"type":27},"Trezor","vendor",{"name":29,"type":27},"ShipMonk",{"name":31,"type":32},"ShinyHunters","threat_actor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":33,"icon":35,"name":36,"slug":37},null,"Breaches","breaches",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61],{"type":58,"value":59,"context":60},"email","help@trezor.io","Sender address used in fake 'critical security alert' phishing emails.",{"type":50,"value":62,"context":63},"SQL injection","Type of vulnerability exploited in Metabase analytics platform."]