decrypted · 13 september 2026 · vulnerabilities and patching · supply chain · surveillance and privacy

The bill comes due for the SSO flaw that hit 138 companies

Last week's story about the Brevo flaw that let one attacker walk into 138 companies' accounts has its first quantified casualty. Trezor, the hardware wallet maker, has confirmed that phishing emails reached roughly 347,000 addresses in its newsletter database, and that 2,500 people clicked through, before the fraudulent domain was taken offline twenty minutes after detection. This is what "access to 138 accounts" looks like once it reaches actual customers.

What actually broke

Brevo is an email marketing platform used by thousands of businesses to run newsletters. According to Brevo's own incident write-up, an attacker set up a normal Brevo account, switched on single sign-on for it, and then invited real Brevo customers' users into that SSO configuration. Signing in through their own identity provider, the attacker was then able to authenticate as those invited users. The bug was that this access was not scoped to the one organisation where SSO had been enabled. It carried over into every organisation those users could otherwise reach.

Think of it as a hotel keycard system with a fault in the scoping logic: a new guest checks in, and their card is meant to open only their own room, but a coding error means it also opens every other room that guest has ever had access to at any of the hotel's other properties. Brevo says the attacker touched 138 accounts, used six of them to send phishing mail and pulled contact lists from 43 more. Trezor, BitBox and CoinTracking were among the customers whose mailing lists were misused. Brevo shut the vector down within two hours of first detecting it, at 08:30 UTC on 10 September.

The Secure by Design lesson

The design decision that would have prevented this is straightforward: authorisation boundaries between tenants in a multi-tenant SaaS product must be enforced by the system itself, not inferred from how an SSO configuration happens to be wired up. Any flow that lets one customer's identity provider vouch for access to another customer's data has skipped a check that should be non-negotiable. For UK organisations, the more useful takeaway sits one layer up: your exposure through a shared marketing or communications platform is only as good as that platform's tenant isolation, and you generally cannot audit it yourself. Newsletter databases feel low-stakes until an attacker uses your own trusted sending domain to deliver a convincing "critical security alert" to your customers, which is exactly the trick used here, dressed up as a fake hardware vulnerability in Trezor's chips. Reviewing which third-party platforms hold your customer contact data, and what happens if that platform's own access controls fail, is a cheaper exercise than explaining a phishing wave to your users afterwards.

Also this week

CISA added four more actively exploited flaws to its watchlist on 9 September: a Fortinet heap overflow (CVE-2025-25249), a Chromium V8 bug (CVE-2026-87491), and two authentication bypass flaws in kit that sits directly on the network edge of many UK organisations, Citrix NetScaler (CVE-2026-19490) and Cisco's Firewall Management Center (CVE-2026-20079). Separately, ConnectWise patched a 9.9-severity flaw in ScreenConnect, the remote access tool widely used by managed service providers, after modified clients were seen pushing malware through live support sessions. All of these share the same shape: authentication or authorisation logic that fails on a path nobody was watching closely enough. If your organisation or your IT provider runs any of this kit, patching is not optional homework.

Natural Resources Wales, the Welsh government body responsible for environmental regulation, confirmed it had inadvertently published a spreadsheet online containing sensitive diversity data for staff employed between 2013 and 2018, including ethnicity, disability and sexual orientation information. NRW says it removed the file, confirmed its deletion and reported the incident to the ICO. It is a reminder that publishing workflows for internal HR data need the same access review as anything a firewall sits in front of, since a misdirected file share can expose special category data just as effectively as any exploit.

Sources

If you would like to talk through what a third-party platform failure like this would mean for your own customer data, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.