Waltio确认Brevo数据泄露涉及用户邮箱：现在该怎么做

Disclaimer: Content does not constitute investment advice. Trading involves risks—please invest with caution!

法国加密税务平台Waltio披露Brevo第三方邮件服务安全事件

法国加密税务平台Waltio已开始向其用户发送电子邮件，告知其使用的第三方邮件服务提供商Brevo发生了安全事件。这封通知措辞冷静、谨慎，且主要旨在安抚用户情绪。这也进一步证实了9月初发生的Brevo数据泄露事件的影响范围比最初想象的更为广泛。

如果您是Waltio的用户，请放心，您的税务报告是安全的。但您的电子邮件地址可能已处于风险之中。在加密货币领域，邮箱地址落入不法分子手中绝非小事。

Waltio究竟向用户传达了什么信息？

这封以法语发送的通知标题为“关于您个人数据安全的信息”，明确了以下四点：

第一，没有恶意邮件从Waltio的账户发出。没有任何冒充Waltio的垃圾邮件被批量发送到联系人列表中。

第二，Brevo的分析仍在进行中。Brevo尚无法确认入侵者是否实际查看或导出了Waltio的联系人列表，仅确认发生了未经授权的账户访问。

Third, the amount of data at risk is limited. Waltio only keeps the email address associated with your Waltio account in Brevo, and the French administrative district code if you fill out voluntarily (i.e., a two-digit administrative district code, such as 75 for Paris, 13 for the Baou de Rhone, etc.). These data are mainly used for regional tax news push and are of limited value individually.

Fourth, the scope of influence is limited to Brevo. Waltio said the tool does not store passwords, API keys, wallet addresses, transaction history or any tax data. Neither login information nor connected exchanges are affected. Waltio also pointed out that Brevo now treats the incident as a closed state.

How big was the Brevo leak?

The impact is far greater than that of a French startup. Brevo said attackers hacked into approximately 120 to 138 customer accounts on September 9 and 10, before access was subsequently cut off. The company later attributed this to authorization vulnerabilities in its login and single sign-on layers, rather than classic password leaks, which meant that attackers could access all organizational data that users who had been consented to have access to.

Brevo's own damage analysis divides losses into three categories: a small number of accounts were used to send phishing emails, dozens of accounts had contact lists exported, and the vast majority of accounts showed no activity. Waltio uses the term "analysis in progress" to indicate that its situation falls between category 2 (contact list exported) and category 3 (no activity), and it is not yet determined which category it falls into.

目前已确认受害者的名单堪称加密行业的“名人录”：Trezor、BitBox、CoinTracking和Solana Mobile。其中Trezor受到的打击最为严重。约有34.7万名新闻通讯订阅者收到了一封关于STM32熵漏洞的虚假安全警报，指向一个要求用户提供钱包备份的应用程序。Trezor在二十分钟内通过DNS级别封锁了该域名，但仍有约2,500人点击了链接。

为何此事对Waltio的影响比对其他Brevo客户更大？

因为Waltio曾经历过更糟糕的情况。在2026年1月，该平台遭受了其自身系统（而非供应商系统）的真实入侵。攻击者窃取了与税务报告生成相关的数据，联系公司索要赎金，巴黎检察官办公室的网络犯罪部门随后将调查移交给了宪兵队国家网络单位。Waltio确认，电子邮件地址、聚合加密余额和税务报告数据已暴露，而密码、API密钥、钱包地址和银行详细信息未受影响。此后在Telegram上流传的一份文件据报道被直接用于针对法国加密持有者。

这段历史改变了此次新事件的风险评估模型。单一的电子邮件地址价值较低，但如果该地址能与显示您大致持有多少加密资产的文件进行交叉引用，它就成了一份精准的目标名单。法国近期发生过一系列针对加密持有者的绑架和家庭入侵案件，而这些案件的起点正是这种数据的拼凑。

因此，正确解读Waltio的通知并非“什么都没发生”，而是“您的另一个标识符可能已在流通中，您应假设攻击者具有耐心”。