Solana Mobile Marketing Account Compromised in Brevo SAML SSO Breach

Solana Mobile's third-party marketing email account was compromised during a wider security incident at email provider Brevo affecting 138 Brevo customer accounts. The incident stemmed from a Security Assertion Markup Language Single Sign-On (SAML SSO) vulnerability in Brevo's infrastructure. Solana Mobile identified unauthorized access to its Brevo account, disabled the account, and is working with Brevo to understand the scope of information accessed. To Solana Mobile's knowledge, no emails were sent from the Solana Mobile account, though the company stated it is continuing to verify this claim with Brevo. Across the 138 compromised Brevo accounts, attackers conducted varied activities. Six accounts were used to send phishing emails to the contacts stored there. Messages sent through those accounts passed usual email authentication checks and looked genuine, according to Brevo. For 43 accounts, contacts were exported by attackers. Ninety-three accounts showed no meaningful activity. Brevo disabled all links in the identified phishing emails as a preventive measure. Solana Mobile builds crypto-focused smartphones for the Solana ecosystem. The company issued a warning to users: Solana Mobile will never ask for your seed phrase, private keys, or wallet recovery details. The statement signals concern that exported contact lists could feed downstream phishing campaigns targeting Solana Mobile users. Solana Mobile has not yet fully verified the scope of information accessed from its compromised Brevo account. Ongoing verification with Brevo remains in progress. Contact data for 43 of the compromised accounts were exported, creating risk of continued targeting of those contacts. The Bottom Line: