“On September 10th at 6:30 AM UTC we identified a security issue where an attacker exploited a flaw in the way Brevo handles SAML SSO to gain access to 138 Brevo accounts. 6 of those accounts were used to send phishing emails to the contacts stored there, and for 43 accounts they exported the contacts,” the company posted last Thursday. “93 accounts have no meaningful activity.”

Brevo added, “The attacker no longer has access. At 8:30 AM UTC we closed the route the attacker used and signed out every user on the platform. There has been no further attacker activity since. We are contacting every affected customer directly with details specific to their account.”

“The attacker created a Brevo account and enabled single sign-on (SSO) on it, then invited legitimate Brevo users into that SSO configuration,” Brevo wrote. “Using their own identity provider, they were able to sign in as those invited users, which by itself is expected behaviour for SSO.” 

The post continued, “This access was not properly scoped: instead of being limited to the single organization where SSO was enabled, it wrongly granted the attacker access to all organizations those users could reach.”

Brevo added, “The root cause is a boundary that was not enforced: a login arriving through one company's SSO configuration should only ever reach that company's account.”