Solana Mobile disclosed on September 12 that an unauthorized party had accessed its account at Brevo, the third-party platform it uses for marketing email. The company disabled the account and said it is working with Brevo to determine what information may have been accessed.
The incident creates a potential phishing risk for Solana Mobile and Seeker users, but the scope remains uncertain. Solana Mobile said that, to its knowledge, no emails were sent from its Brevo account. It has not disclosed what data was stored in the account, how many people may be affected or whether its contact list was exported.
The distinction is important: this was unauthorized access to a third-party marketing account. There is no evidence that the Solana network, Seeker devices, Seed Vault, user wallets or customer funds were compromised.
Key Findings
- Solana Mobile identified unauthorized access to its Brevo marketing account and disabled the account while the company investigates what information was accessed.
- Brevo said a SAML single sign-on flaw exposed 138 customer accounts; contact lists were exported from 43 accounts and six accounts were used to send phishing emails.
- Solana Mobile has not confirmed that its contact list was exported or that emails were sent from its account, and there is no evidence that Solana infrastructure, devices or wallets were breached.
What Happened?
In an official statement published on X, Solana Mobile said Brevo had experienced a security incident affecting several customer accounts, including its own. The company said it found unauthorized access, disabled the account and began working with Brevo to understand the scope of the information viewed.
Solana Mobile added that it had not found evidence that emails were sent from its account, although verification was continuing. It also reminded users that it will never ask for a seed phrase, private key or wallet-recovery information.
How the Brevo Access Worked
Brevo's official incident report said it detected the security issue at 6:30 a.m. UTC on September 10. An attacker exploited a failure in how the platform scoped access through SAML single sign-on, or SSO.
According to Brevo, the attacker created a Brevo account, enabled SSO and invited legitimate Brevo users into a configuration controlled by the attacker. The resulting login access should have been restricted to the organization that owned the SSO configuration. Instead, it extended to other organizations those invited users could reach.
Brevo said 138 customer accounts were accessed. Six were used to send phishing emails, contact lists were exported from 43 and 93 showed no meaningful attacker activity. These are platform-wide figures, not figures for Solana Mobile. Brevo has not publicly identified which of those groups included the Solana Mobile account.
The provider closed the access route at 8:30 a.m. UTC on September 10, signed every user out and said it had seen no further attacker activity. It also said a permanent fix was being deployed to restrict SSO access to the organization that owns each configuration.
What Is Known About Solana Mobile’s Account
The confirmed facts are limited. Solana Mobile's Brevo account was accessed without authorization, the company detected the access and the account was disabled. The investigation into what information was viewed remains open.
It is not yet known whether the account contained only email addresses or additional contact information. Solana Mobile has not disclosed an affected-user count, and it has not confirmed that any contact list was downloaded. Its statement that no emails were sent from the account is also qualified by the continuing verification with Brevo.
Nothing disclosed so far indicates access to Solana Mobile's product infrastructure. A marketing database incident does not establish compromise of the Solana blockchain, Seeker hardware, Seed Vault or wallets used on the device.
Why Seeker Users Should Be Cautious
Email-provider compromises can make phishing unusually convincing because messages may originate from legitimate sending infrastructure. Brevo acknowledged that phishing emails sent through the affected accounts passed ordinary email-authentication checks and appeared genuine.
If Solana Mobile contact data was exported, it could be used later for targeted messages that imitate security notices, device updates, wallet-recovery procedures or support requests. That is a risk scenario rather than a confirmed outcome for this account, but it explains why the company issued a wallet-safety reminder before the scope of the exposure was fully known.
The most sensitive request in any such message would be for a seed phrase, private key or recovery information. Possession of those credentials can allow an attacker to control the associated wallet, regardless of whether the device or blockchain itself has any technical vulnerability.
What Users Should Do Now
- Do not provide a seed phrase, private key or wallet-recovery details in response to an email, form or support message.
- Do not install software or approve wallet transactions through links in unexpected security alerts.
- Open Solana Mobile services through a saved official address or the device's normal interface instead of following an email link.
- Treat messages about urgent wallet migration, Seed Vault verification or account recovery as suspicious until independently confirmed through an official Solana Mobile channel.
What Comes Next
The central unanswered question is whether information was merely viewed in Solana Mobile's account or whether a contact list was exported. Solana Mobile is working with Brevo to establish that scope, including whether any users require direct notification.
Until that review is complete, the incident should be described as a confirmed third-party account breach with an unresolved data-exposure and phishing risk—not as a compromise of Solana, Seeker or user wallets.
Primary Sources & Data
- Solana Mobile — Security Incident Statement, September 12, 2026: Confirms unauthorized access to the company's Brevo account, its suspension and the continuing investigation.
- Brevo — Attacker Gained Access to Client Accounts: Provides the platform-wide account totals, SAML SSO root cause, containment timeline and remediation steps.
Sources & Methodology
This report prioritizes statements from Solana Mobile and Brevo. Platform-wide Brevo figures are kept separate from the still-undisclosed impact on Solana Mobile. The article does not infer that contact data was exported, that phishing emails were sent from Solana Mobile's account or that any device, wallet, Seed Vault component or blockchain infrastructure was compromised.
Responses (0 )