"Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain."
I’ve complained upstream to them before about their (lack of) security processes making downstream distro package management more difficult: https://github.com/trezor/trezord-go/issues/293
7 comments
[ 0.23 ms ] story [ 24.8 ms ] thread"Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain."
2022: Their Mailchimp account breached
2024: Their support ticket portal breached
2025: Support contact form sent phishing via official auto-replies
Aug 2026: Shipping partner ShipMonk breached
Sep 2026: Email provider breached
Anything Trezor knows about you should be considered thoroughly compromised.