What Brevo's SSO incident teaches about multi-tenant SAML and hijacked sending accounts.

Brevo's incident write-up says an attacker exploited a flaw in how it handled SAML single sign-on and reached 138 customer accounts. Brevo identified the issue at 06:30 UTC on 10 September. At 08:30 UTC it closed the route the attacker used and signed out every user on the platform. Brevo says six of the accounts were used to send phishing and that contacts were exported from 43.

Trezor, which uses Brevo for its newsletter, said phishing was sent from its account to roughly 347,000 email addresses, warning of a fake hardware vulnerability and directing recipients to enter their wallet backup. Trezor says its products, wallets and account systems were not affected.

Brevo's summary of the principle that was violated is admirably direct: a login arriving through one company's SSO configuration should only ever reach that company's account. That was not how access was scoped.

According to Brevo, the attacker created their own account, enabled SSO on it, and invited legitimate Brevo users into that SSO configuration. That wrongly granted access to every organisation those users could already reach. Brevo's permanent fix limits SSO access strictly to the organisation that owns the SSO configuration.

SPF, DKIM and DMARC exist to stop someone sending mail that pretends to come from your domain. They do nothing when the mail genuinely comes from your domain, through your own sending provider, from your own account. Brevo says the phishing passed the usual email authentication checks.

For any company whose customers trust its emails, the useful question is operational rather than technical: who can suspend your sending account, and how fast? In an incident like this, minutes matter, and the answer should be written down before you need it.

The pattern behind this flaw is not specific to email providers. Any multi-tenant product with both SSO and an invite flow has the same shape of risk. Use this as a test plan.