Trezor warns users of email provider breach, phishing attacks
Trezor says attackers breached its third-party email provider and are phishing customers with fake STM32 entropy vulnerability alerts.
Trezor warned customers that threat actors breached its third-party email provider and sent fake 'Critical Security Alert: STM32 Entropy Vulnerability' emails from help@trezor.io, claiming wallet seeds were exposed to brute-force attacks; the phishing domain has been taken down while Trezor investigates. This follows the ShipMonk breach, revised upward from about 14,000 to 81,000 customers (including 67,000 additional US customers) who received orders between May 10 and August 8, 2026. Attackers reportedly exploited a Metabase SQL injection zero-day to access ShipMonk data, and ShinyHunters sent extortion emails.
- Fake emails claimed an STM32 microcontroller flaw exposed wallet seeds to brute-force cracking
- ShipMonk breach impact revised upward to 81,000 customers across multiple countries
- Attackers exploited a Metabase SQL injection zero-day to steal ShipMonk customer data
- ShinyHunters extortion gang sent emails to ShipMonk after the breach
- Products
- STM32
- Threat actors
- ShinyHunters
- Victims
- Trezor customers
- Organizations
- BleepingComputer
From the original article
2 min read at bleepingcomputer.com
Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.