Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #8[unverifiable][awaiting moderator]in section: Secondary Attack: Brevo Supply Chain Compromise (September 14, 2026)

   “Using a long-lived Cloudflare API key that had been hardcoded in Brevo's application source code and carried full account permissions, the attacker deployed a malicious Cloudflare Worker.”

   reviewerSept 14 attack used a hardcoded Cloudflare API keyThe 'hardcoded' and 'full account permissions' details were not seen in SecurityWeek. They may appear in Sansec or BleepingComputer, which I did not read.
   citedwww.securityweek.com/brevo-supply-chain-…100000-websites/
2. #11[unverifiable][awaiting moderator]in section: Prior Incident: ShipMonk Breach (August 2026)

   “(CVE-2026-72898, CVSS 10.0)”

   reviewerCVE-2026-72898 with CVSS 10.0Trezor's post does not name a CVE. The identifier is cited only to a secondary vendor blog (Rescana), which I did not fetch.
   citedwww.rescana.com/post/trezor-shipmonk-bre…y-cve-2026-72898
3. #12[unverifiable][awaiting moderator]in the timeline

   “Mailchimp, a prior Trezor email marketing provider, suffered a social engineering attack that exposed approximately 100 Trezor user accounts and enabled a targeted phishing campaign.”

   reviewerMailchimp April 2022 incident sent phishing to about 100 Trezor users; timeline entry cites The Register 2026 articleI did not fetch The Register article, and the 2026 article is an indirect source for an April 2022 event. The 2022 Mailchimp incident is publicly known (about 100 Trezor users), but I did not verify the exact day. The date is a month-level placeholder (2022-04-01).
   citedwww.theregister.com/cyber-crime/2026/09/…ng-spree/5295496

The cited evidence supports part of the claim but not all of it.

1. #3[partially supported][awaiting moderator]in section: Technical Attack Vector: SAML SSO Boundary Failure

   “Brevo deployed a permanent fix on September 10, 2026 that strictly limits SSO access to the organization that owns the SSO configuration.”

   reviewerBrevo deployed the permanent fix on Sept 10The write-up says the fix was being deployed, not that it was completed on Sept 10. The claim that Brevo filed legal complaints was not seen in the fetched text.
   citedstatus.brevo.com/incidents/pawbvhq8/write-up
2. #4[partially supported][awaiting moderator]in the timeline

   “Brevo force-signed out all platform users and deployed a permanent SSO scope-restriction fix.”

   reviewerTimeline: Brevo force-signed out all users and deployed a permanent SSO scope-restriction fix on Sept 10Same overstatement as sections[1].
   citedstatus.brevo.com/incidents/pawbvhq8/write-up
3. #6[partially supported][awaiting moderator]in section: The Phishing Campaign: Fabricated STM32 Entropy Vulnerability

   “No confirmed cryptocurrency losses have been publicly attributed to the campaign as of September 17, 2026.”

   reviewerThe Trezor post states there were no confirmed losses as of Sept 17 and the Sept 17 updateAbsence of reported losses is consistent with the sources, but the Sept 17 post does not make that statement affirmatively. My search found no later update.
   citedtrezor.io/blog/news/security-incident-at…y-email-provider
4. #9[partially supported][awaiting moderator]in section: Secondary Attack: Brevo Supply Chain Compromise (September 14, 2026)

   “Between approximately 16:05 and 20:13 UTC on September 14, the worker modified content at the CDN edge”

   reviewerWorker active 16:05-20:13 UTC; over 100,000 websites affected; three JS files; brevo.com and sibforms.comEverything except the exact clock times is supported. A 16:05-20:13 window is about 4 hours, consistent with the 'served' figure from Sansec. Sansec was not read.
   citedwww.securityweek.com/brevo-supply-chain-…100000-websites/
5. #13[partially supported][awaiting moderator]in section: Broader Impact: Other Affected Vendors

   “implying the six weaponized accounts spanned multiple vendors beyond Trezor alone.”

   reviewerBrevo's six phishing accounts spanned multiple vendorsThis is explicitly an inference, correctly hedged. Search results corroborate that CoinTracking and BitBox warned users.
   citedstatus.brevo.com/incidents/pawbvhq8/write-up

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Incident Overview

   “to gain unauthorized access to 138 Brevo customer accounts. Of those, six accounts were used to send phishing emails to the contact lists stored within them, and 43 accounts had their contact lists silently exported.”

   reviewerAttackers gained access to 138 Brevo accounts; 6 sent phishing and 43 had contacts exportedMatches Brevo write-up. Trezor's post says 120 accounts; the page does not note the discrepancy.
   citedstatus.brevo.com/incidents/pawbvhq8/write-up
2. #2[confirmed][no action needed]in section: Incident Overview

   “Brevo detected the intrusion at 6:30 AM UTC on September 10 and closed the access route by 8:30 AM UTC.”

   reviewerBrevo detected at 6:30 AM UTC Sept 10 and closed access by 8:30 AM UTCConfirmed.
   citedstatus.brevo.com/incidents/pawbvhq8/write-up
3. #5[confirmed][no action needed]in the summary

   “approximately 2,500 users clicked the malicious link before Trezor disabled the phishing domain within 20 minutes.”

   reviewerApproximately 347,000 recipients, 2,500 clicks, and 20-minute takedownConfirmed by Trezor's post.
   citedtrezor.io/blog/news/security-incident-at…y-email-provider
4. #7[confirmed][no action needed]in the timeline

   “Trezor updated its disclosure to confirm 347,149 total marketing contacts were affected by the Brevo breach.”

   reviewerTrezor suspended its Brevo account and the Sept 17 update confirmed 347,149 contacts affected (exported)Substantively correct; the confirming party was Brevo, relayed in Trezor's update.
   citedtrezor.io/blog/news/security-incident-at…y-email-provider
5. #10[confirmed][no action needed]in section: Prior Incident: ShipMonk Breach (August 2026)

   “Trezor initially disclosed on August 13, 2026 that approximately 13,689 customers who placed orders between May 10 and August 8, 2026 had names, email addresses, phone numbers, and shipping addresses exposed.”

   reviewerShipMonk dates and customer countsConfirmed. Trezor gives a total of 80,689 (rounded to 81,000 by BleepingComputer).
   citedtrezor.io/blog/news/recent-customer-data…rovider-incident