UPDATE: A login flaw in email platform Brevo let an attacker access 138 client accounts, including Trezor, which they used to send a phishing email to Trezor's subscribers.