Brevo Confirms Supply-Chain Attack Involving Malware

Brevo has confirmed a serious supply-chain attack that allowed attackers to insert malicious ClickFix scripts into its customers' websites. The attack was facilitated by the theft of a Cloudflare API key, which eased the attackers' access to Brevo's infrastructure. The affected scripts were embedded in the JavaScript files used on the customers' websites. The vulnerability was discovered after several Brevo customers reported unexpected malware activities on their websites. The attackers exploited the compromised API to inject the malicious scripts, which then spread malware to users' devices.

In response, Brevo took immediate action to close the security gap and inform the affected customers. In an initial analysis, Brevo found that the attackers were able to intercept not only the API keys but also other sensitive data. The exact number of affected customers and the nature of the stolen data are currently unclear. Brevo is collaborating with security experts to fully investigate the incident and assess its impact. Authorities have been informed about the incident, and Brevo has initiated a comprehensive investigation.

The company has also urged its customers to review their security measures and, if necessary, change their API keys. Experts warn that such attacks are becoming increasingly common in today's digital landscape. The use of Cloudflare as part of Brevo's infrastructure has previously provided additional security. However, the current incident raises questions about the security of third-party services. Companies relying on such services must regularly review and adjust their security protocols to prevent similar incidents.

Brevo has announced plans to overhaul its security architecture to better defend against future attacks. This includes implementing additional security measures and training employees to handle security threats. The company also plans to regularly inform its customers about security updates and best practices. Cybersecurity incidents are on the rise globally. According to a recent study, by 2026, 45% of companies in the U.S. had already been affected by a similar attack.

The increasing number of such incidents shows that companies must take proactive measures to protect their systems. Brevo is committed to enhancing transparency regarding the incident and will provide regular updates on the situation. Customers can stay informed about the latest developments on Brevo's official website. The incident has already led to an increase in inquiries from customers wanting to learn more about the company's security practices. Investigations into this incident are still ongoing, and Brevo has announced that it will publish all relevant information as soon as it becomes available.

The vulnerability is considered one of the most serious threats to the digital infrastructure of companies. Experts advise regularly reviewing and updating security protocols to protect against such attacks. The exact number of affected customers and the type of malware that was spread are currently unknown. However, Brevo has confirmed that the vulnerability has been promptly closed and that the affected customers have been informed.

The incident has already led to an increase in security measures in many companies. The vulnerability was discovered on September 17, 2026, and Brevo took immediate action to neutralize the threat. The company has also urged its customers to review their security practices and make adjustments if necessary.