Trezor's email provider has been breached

twitter.com

20 points·andreyazimov··7 comments

Open articleView on HN

Their devices have never been [known to be] remotely breached, but still…

2022: Their Mailchimp account breached

2024: Their support ticket portal breached

2025: Support contact form sent phishing via official auto-replies

Aug 2026: Shipping partner ShipMonk breached

Sep 2026: Email provider breached

Anything Trezor knows about you should be considered thoroughly compromised.

B2B SaaS doesn't have the level of security that crypto needs.

https://archive.today/H4hbC

"Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.

We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain."

I read that as "Trent Reznor's email was hacked" which would have less impact, but contains more interesting info I bet.

Trent Reznor on good email providers: "I just want something I can never have" (maybe)

I’ve complained upstream to them before about their (lack of) security processes making downstream distro package management more difficult: https://github.com/trezor/trezord-go/issues/293

https://xxcancel.com/Trezor/status/2097786518110609620

Reply on news.ycombinator.com