Case period: 2026-09-09. This article is a retrospective review.
Reported timeline
Trezor reported a security incident at its third-party email provider Brevo following unauthorized newsletter activity on 9 September 2026. Its notice was published on 10 September and updated on 17 September. According to the company, attackers sent messages directing recipients toward a fake application and exported subscriber email addresses.
Affected data and affected wallets are different questions
Trezor said the incident did not compromise its hardware wallets or wallet systems. That statement does not make the stolen contact information harmless: a recipient can receive a highly relevant-looking message that refers to a real product they use. The notice concerns the provider's incident and the company's investigation, not an independent audit by Wallet Beep.
A response that matches the exposure
Treat an unexpected wallet-update email as a prompt to open the vendor's known official site independently. Do not install an application from the message or submit a wallet backup to its form. Preserve the message if reporting it, including the sender details and destination link without opening that link. Separate receipt of the email, downloading a file and disclosing a secret when explaining what happened; each represents a different level of exposure.
Source and review date
Trezor — original source. Source published: 2026-09-10. Source updated: 2026-09-17. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.