Trezor Says External Email Provider Was Breached, ‘Security Vulnerability’ Message Is Phishing
Summary
- Trezor said a third-party email provider was breached, leading to the spread of phishing emails impersonating the company.
- It warned that the email with the subject line 'Critical Security Alert: STM32 Entropy Vulnerability' was not sent by Trezor and that users should not click the link.
- The domain used in the phishing campaign has been blocked, and the company is investigating how the attack happened and what caused it, but it did not say whether user assets or hardware wallets were affected.
Forecast Trend Report by Period
Trezor, the hardware wallet maker, warned users to be on alert for phishing emails impersonating the company after a security breach at an external email service provider.
On Sept. 9, Trezor wrote on its official X account that “a third-party email provider was compromised” and that emails with the subject line “Critical Security Alert: STM32 Entropy Vulnerability” were not sent by the company but were part of a phishing attempt.
The company urged users not to click any links included in the email.
The domain used in the phishing campaign has been blocked. Trezor said it is investigating the cause of the incident, including how attackers were able to access the company’s legitimate domain.
Trezor did not disclose in the announcement whether user assets or the hardware wallets themselves were affected, or provide additional details on the extent of the damage.
Suehyeon Lee
shlee@bloomingbit.ioI'm reporter Suehyeon Lee, your Web3 Moderator.