Multiple crypto companies warn customers of phishing emails after alleged provider breach

Thousands of cryptocurrency holders were inundated with phishing emails on Wednesday after hackers breached an email provider and sent out corrupted messages. 

Trezor and BitBox did not confirm which email provider was breached, but CoinTracking said email service provider Brevo was the source of the phishing emails. 

Brevo did not respond to requests for comment but released its own notice on Thursday morning warning that an attacker had access to 120 customer accounts. 

“The bad actor used the access to send phishing emails to the client's contactbase. The access has been closed,” the company said, pledging to post a full post mortem at a later date. 

Brevo was founded in Paris as an email marketing firm in 2012, and raised more than $580 million in December to help expand to other parts of the customer relationship management business. 

Security alert phishing

Each of the emails sent out used the legitimate company domains and purported to be focused on security issues requiring customer action. 

People who received the emails said they were alarmed at how legitimate they looked, and several clicked on the links before being taken to phishing websites that were nearly identical to the legitimate platforms.