The incident matters for users because it highlights how widely used marketing and notification providers can become a bridge for account-based compromise—one that can bypass typical email authentication safeguards and reach audiences that expect legitimate updates. In a Thursday postmortem, Brevo described how the attacker exploited a vulnerability in its login system to reach other organizations. Brevo said six accounts were used to send phishing emails. It also reported that contacts were exported from 43 accounts, while 93 accounts showed no meaningful activity. The company did not clarify whether those categories overlapped.