By Cybersecurity Desk
Published: September 2024
Main Facts
Customer engagement platform Brevo has disclosed a significant security incident that underscores a critical vulnerability in modern enterprise identity management and email authentication. An unauthorized actor successfully exploited a structural flaw in how Brevo’s platform handled Security Assertion Markup Language (SAML) single sign-on (SSO). This vulnerability granted the attacker unauthorized access to a total of 138 customer accounts.
Within this compromised cohort, the malicious actor weaponized six high-profile accounts to launch targeted phishing campaigns using Brevo’s own legitimate email-sending infrastructure. Concurrently, the attacker exported sensitive contact data from an additional 43 accounts. Brevo’s initial incident disclosures noted that the remaining 93 accounts exhibited no meaningful attacker activity; however, a minor statistical discrepancy exists within the company’s published figures. The sum of the active phishing group (6), the data export group (43), and the quiescent group (93) totals 142 accounts—four more than the officially stated total of 138. This mathematical variance suggests an overlap between targeted groups that Brevo’s preliminary public post-mortem did not explicitly clarify.
The root cause of the breach was a failure in session and organization boundary scoping post-authentication. The attacker established a rogue Brevo account, configured an identity provider under their exclusive control to enable SAML SSO, and subsequently invited legitimate, external Brevo users into this malicious configuration. Because the platform failed to properly restrict access exclusively to the specific organization where the SSO had been established, the attacker gained lateral movement capabilities. Once the invited users authenticated, the attacker was able to access every other organization and workspace those users were already authorized to access.
High-profile cryptocurrency and hardware wallet enterprises, including Trezor and CoinTracking, were among those directly impacted. The breach illustrates a terrifying reality for cybersecurity professionals: traditional email authentication protocols—such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance)—are structurally blind to whether the entity pressing "send" inside a legitimate infrastructure is authorized to do so. When an adversary hijacks an authorized channel, all standard trust signals remain green, effectively bypassing perimeter defenses designed to protect enterprise inboxes.
Chronology of the Incident
Understanding the timeline of the Brevo security event is vital for mapping the speed at which modern credential compromises can escalate into widespread downstream attacks. Based on disclosures from Brevo and affected enterprise customers, the sequence of events unfolded as follows:
- Pre-Discovery Phase (Attacker Setup): The malicious actor weaponized Brevo’s SAML configuration mechanics by setting up a fraudulent control environment. By inviting legitimate users into a controlled identity provider schema, the attacker laid the groundwork for unauthorized cross-organization access long before internal monitoring flags were raised.
- September 10, 2024 – 06:30 UTC: Brevo’s security monitoring and internal telemetry systems identified anomalous activity pointing to unauthorized account access and potential abuse of its outbound infrastructure.
- September 10, 2024 – 08:30 UTC (Two Hours Post-Detection): Brevo security engineers successfully closed the active exploit vector that allowed the SAML misconfiguration vulnerability. Simultaneously, the platform initiated a global termination and reset of all active user sessions to purge potential persistence mechanisms maintained by the attacker.
- Post-08:30 UTC, September 10, 2024: According to Brevo’s incident response team, no further malicious activity, unauthorized access attempts, or secondary data exfiltrations have been detected since the sessions were forcibly invalidated.
- Immediate Remediation Phase: Brevo began notifying affected organizations while simultaneously developing and deploying a permanent infrastructural patch. This permanent fix enforces strict tenant isolation, ensuring that SAML SSO access parameters are tightly bound exclusively to the organization that owns and administers the specific configuration.
Supporting Data and Data Discrepancies
A granular review of the metrics provided by Brevo and its impacted enterprise partners reveals notable statistical nuances and minor reporting discrepancies that demand careful analysis by security auditors:
The Brevo Metrics Breakdown
- Total Compromised Accounts: 138 accounts identified as accessed by the unauthorized actor.
- Phishing Launchpads: 6 accounts actively utilized to dispatch malicious email campaigns via genuine infrastructure.
- Data Exfiltration Targets: 43 accounts from which contact lists and metadata were systematically exported.
- Quiescent/Unexploited Accounts: 93 accounts where access was achieved, but no active manipulation or data export was recorded.
- The Discrepancy: As noted, $6 + 43 + 93 = 142$, representing a four-account variance over the stated total of 138. Industry analysts attribute this to accounts that suffered dual impacts—such as being both utilized for limited data export and experiencing active phishing deployments—causing them to be counted across multiple operational categories in raw telemetry reviews.
The Trezor Metrics Variance
- Trezor’s Internal Account Count: In its dedicated post-incident disclosure, hardware wallet manufacturer Trezor reported that its investigations indicated 120 Brevo accounts were hit globally—a figure diverging from Brevo’s baseline of 138.
- Audience Reach: The phishing campaign launched via Trezor’s compromised Brevo infrastructure targeted an opt-in newsletter subscriber database comprising 347,149 individual email addresses.
- Velocity and Mitigation Speed: Trezor’s incident response engineers identified the anomaly and executed a DNS-level domain takedown of the malicious infrastructure within 20 minutes of the initial blast.
- Click-Through Rates: Despite the rapid 20-minute containment window, telemetry shows that approximately 2,500 individuals (roughly 0.72% of the total recipient pool) clicked the malicious URL before the DNS records were successfully scrubbed.
- Collateral Damage: Trezor confirmed zero compromise to its proprietary product lines, internal cold-storage hardware wallets, or user account ecosystems. The attack was strictly confined to the third-party email distribution pipeline.
Official Responses and Enterprise Statements
Major stakeholders have released detailed post-mortems outlining their involvement, the nature of the payloads delivered, and the steps taken to secure their respective perimeters.
Brevo’s Official Statement
Brevo’s engineering and security leadership moved quickly to publish a detailed incident write-up via their status infrastructure. The company confirmed that the vector relied on sophisticated manipulation of SAML SSO boundaries. Brevo emphasized that the root vulnerability has been neutralized:
"The attacker exploited a flaw in how Brevo handles SAML single sign-on. They created a Brevo account, enabled SSO using an identity provider they controlled, and invited legitimate Brevo users into that configuration. The problem came after authentication: access wasn’t properly scoped to the organisation where SSO had been set up, so the attacker could reach every other organisation those invited users already had access to."
Brevo reiterated that its immediate response involved closing the vector within two hours of identification, globally invalidating active sessions, and deploying permanent architectural restrictions to ensure strict tenant isolation for all future SAML integrations.
Trezor’s Security Notice
Hardware wallet pioneer Trezor released an official advisory titled "Security Incident at Brevo: Our Third-Party Email Provider," detailing how their marketing infrastructure was weaponized to target cryptocurrency holders. Trezor noted:
"Trezor confirmed its Brevo account was one of those hit. A phishing email headed ‘Critical Security Alert: STM32 Entropy Vulnerability’ went out to Trezor’s opt-in newsletter list… directing recipients to a fake app that asked for their wallet backup."
Trezor stressed that the phishing content was crafted with high sophistication, leveraging the genuine corporate sender reputation of the brand to instill false confidence. However, Trezor reassured its global user base that its own security perimeters remained completely unbreached, and no internal systems or user funds were exposed.
CoinTracking’s Security Notice
Crypto portfolio tracking platform CoinTracking also issued a formal security notice acknowledging that its outreach pipeline was compromised during the incident. CoinTracking confirmed that a fraudulent notification—specifically themed around data breach alerts and prompting users to refresh API keys—was disseminated through Brevo’s pipeline. CoinTracking’s official statement assured clients that:
"…its own systems, passwords, API keys and portfolio data were entirely unaffected by the third-party infrastructure breach."
Implications for the Cybersecurity and Deliverability Landscape
The Brevo security incident serves as a critical watershed moment for enterprise cybersecurity, identity and access management (IAM), and email deliverability engineering. The attack shatters several long-held assumptions regarding infrastructure trust and perimeter security.
1. The Fallacy of "Authenticated" Deliverability
For decades, the cybersecurity industry has urged organizations to implement strict email authentication protocols: SPF to declare who can send mail on behalf of a domain, DKIM to cryptographically sign messages and guarantee integrity, and DMARC to dictate policy enforcement when checks fail.
However, the Brevo incident demonstrates that authentication is not authorization. SPF, DKIM, and DMARC verify where an email came from, not who was sitting at the keyboard when it was dispatched. Because the threat actor hijacked a legitimate, pre-authorized Brevo infrastructure pipe, every single trust signal evaluated by receiving mail servers (Google, Microsoft, Yahoo, etc.) returned a positive validation. Spam filters, which rely heavily on domain reputation and authentication alignment, cleared the phishing emails straight into the primary inboxes of hundreds of thousands of users. This represents a profound architectural blind spot in modern email security ecosystems.
2. The Danger of Implicit Trust and Cross-Organization Over-Privileging
The root cause of the Brevo breach—insufficient tenant scoping following SAML SSO authentication—highlights a pervasive flaw in multi-tenant SaaS applications: implicit cross-organization trust.
When modern knowledge workers maintain administrative or collaborative access across multiple disparate corporate accounts using unified identity providers, SaaS platforms must rigorously sandbox sessions. If an application allows an authenticated session in Organization A to seamlessly traverse boundaries into Organization B simply because a user shares a login credential, the blast radius of a single compromised identity provider or invitation vector expands exponentially. Software vendors must adopt zero-trust principles internally, treating every cross-tenant interaction as untrusted by default.
3. Supply Chain Risk Beyond Software Dependencies
Enterprise risk management has traditionally focused on software supply chain vulnerabilities—such as malicious npm packages, compromised open-source repositories, or vulnerable API endpoints. The Brevo incident forcefully reminds organizations that third-party communications infrastructure represents an equally critical, high-impact attack surface.
When a company outsources its newsletter distribution, customer notifications, and marketing automation to a third-party SaaS provider, it implicitly grants that vendor the cryptographic ability to speak directly to its customer base under the brand’s banner. If the vendor’s IAM controls fail, the third-party provider transforms from a valuable business utility into a high-leverage proxy for social engineering.
4. Recommendations for Enterprise Security Teams
In the wake of this incident, cybersecurity architects and IT administrators are urged to re-evaluate their operational security posture regarding third-party communications and IAM configurations:
- Enforce Strict Tenant Isolation Audits: SaaS vendors must conduct rigorous code reviews and penetration testing specifically focused on SAML, OIDC, and multi-tenant authorization boundaries to prevent cross-account lateral movement.
- Assume Compromise of Outbound Channels: Organizations relying on third-party email platforms must implement robust out-of-band anomaly detection for outbound mailing volumes, velocity spikes, and template modifications.
- Educate End Users on Authenticated Phishing: Security awareness training must evolve beyond teaching users to look for broken links or failed DMARC checks. Users must be trained to recognize social engineering tactics—such as urgent demands for private keys, seed phrases, or API key regenerations—even when emails arrive from verified, trusted corporate sender addresses.
- Minimize Cross-Tenant Privileges: Enterprises should audit corporate user accounts to ensure personnel do not maintain standing administrative access across unnecessary external third-party portals and workspaces.
Ultimately, the Brevo breach is a stark reminder that as defensive perimeter technologies grow increasingly sophisticated, attackers will systematically target the structural seams where identity management, third-party SaaS platforms, and human trust intersect.
