Hardware cryptocurrency wallet maker Trezor has warned customers about a security incident involving Brevo, a third-party email provider used by the company. 

The breach gave hackers access to information that enabled them to send approximately 347,000 phishing emails to Trezor customers. 

The messages were designed to appear legitimate and contained malicious links that directed users to fraudulent applications.

The phishing emails reportedly used alarming subject lines, including a warning about a supposed security vulnerability affecting Trezor wallets. 

Victims who followed the instructions were asked to provide their wallet backup password. 

Trezor warned that anyone who obtains such credentials could potentially gain access to cryptocurrency funds, which can be transferred irreversibly through blockchain transactions.

Brevo said hackers gained access to 138 customer accounts and exploited a security weakness that allowed their access to extend beyond the intended limits. 

Trezor stressed that its own wallets, products and account systems were not compromised. 

However, the incident demonstrates the risks companies face when sensitive customer information is handled by external service providers.

The latest incident comes shortly after another data breach involving one of Trezor’s shipping partners. 

That breach exposed personal information belonging to tens of thousands of customers, including names, telephone numbers, email addresses and postal addresses. 

Trezor has warned that such information could be used for further phishing attempts or even targeted physical attacks against cryptocurrency owners.

Trezor has said it is reviewing its relationships with third party vendors following the incidents. 

The company has also urged customers to remain cautious about unexpected emails, letters and messages requesting wallet credentials, particularly because attackers may continue using exposed contact information in future scams.

Source: TechCrunch