The Phishing Email Really Came From Trezor. That Was the Problem.
The sender was legitimate. The message was not. A Brevo compromise let an attacker use Trezor's newsletter channel to distribute a wallet-backup phishing lure.
Trezor
Another 67,000 Trezor Customers Were Exposed by Data ShipMonk Said It Had Deleted
Trezor says ShipMonk retained data it had promised to delete, exposing another 67,000 US customers to phishing and potential physical-security risk.