Business email security does not rely only on SPF, DKIM, and DMARC. The two Brevo incidents of September 2026 show that an unautorized account or a compromised infrastructure key can bypass these protections. To reduce risk, an SMB must separate access, enforce multi-factor authentication, limit permissions, govern API keys, and monitor unusual campaigns.
What happened at Brevo in September 2026?
Brevo experienced two separate incidents in September 2026: an isolation flaw between customers using SAML SSO authentication, then the hijacking of a Cloudflare credential. The first incident made it possible to access customer accounts. The second injected a malicious script into content hosted or distributed by Brevo.
On September 10, 2026, Brevo confirmed unautorized access to 138 accounts. According to the report published by the company, 6 accounts were used to send phishing, 43 had a contact export, and 93 did not experience significant malicious activity. Brevo says it closed the SSO access path in less than two hours and reset active sessions.
BitBox separately confirmed the export of its full list and the sending of two phishing campaigns. Trezor had detected as early as September 9, 2026 the unautorized use of its newsletter account. These events illustrate a risk that is often underestimated: an exported address can fuel targeted attacks long after the technical resolution of the incident.
On September 14, 2026, another incident affected pages, forms, Conversations widgets, and software development kit loaders, or SDKs, served by Brevo. According to Brevo’s report, an old Cloudflare API credential, granted full privileges and stored in application code, had been compromised.
The ClickFix injection lasted about five and a half hours, between approximately 16:05 and 20:30 UTC according to the windows published by Brevo and Sansec in 2026. ClickFix refers to a technique that displays fake troubleshooting instructions in order to get the user to execute a malicious command themselves. The script notably targeted Windows users and attempted to install a WordPress plugin when a logged-in administrator visited an affected site.
Sansec estimated in September 2026 that the affected Brevo scripts were integrated into more than 100,000 sites. This figure measures potential exposure, not the number of sites actually compromised, which Brevo did not publish. Brevo also stated that email sending, the API, app.brevo.com, and customer account data had not been affected by this second event.
Why didn’t SPF, DKIM, and DMARC stop the phishing?
SPF, DKIM, and DMARC verify whether a server or domain is autorized to send a message, but they do not determine whether the campaign is legitimate. In September 2026, the fraudulent messages sent from compromised Brevo accounts used autorized infrastructure and therefore were able to pass the usual authentication checks.
SPF indicates which servers can send for a domain. DKIM adds a cryptographic signature to the message. DMARC defines what to do when a message fails these checks and provides reports. According to the National Institute of Standards and Technology in 2026, these mechanisms remain necessary against domain spoofing and also contribute to deliverability.
But they answer the question “is this sender autorized?”, not the question “has this campaign been approved by the company?”. When an attacker takes control of an account that is already autorized, the email can be technically authentic while still being malicious. This is precisely the trap that non-technical decision-makers often ignorent.
Business email security must therefore add a business control layer: alert thresholds on volume sent, validation of sensitive campaigns, monitoring of new senders, and review of contact exports. A sudden change in the login country, the number of recipients, or the destination domain also deserves an alert.
On the projects we carry out, we often see domain authentication treated as the end of the project. It is more its foundation. Deliverability issues and campaign anomalies must then be monitored together, because the causes of a drop in open rates can also reveal a degraded configuration or unusual use.
How can business email security be strengorened?
Robust business email security combines named accounts, multi-factor authentication, minimum permissions, and limited technical credentials. In 2026, Brevo allows separate control of rights over contacts, exports, campaigns, domains, and API or SMTP credentials. This granularity reduces the impact of compromised access.
A named account belongs to one person only. It makes it possible to quickly remove access and attribute an action to its author, unlike a shared administrator password. Service providers must have their own access, limited to their assignment and disabled as soon as the contract ends.
Here are the controls to apply as priority:
- enforce two-factor authentication, or 2FA, for all administrators and extend it to SSO logins;
- reserve the export of contacts for people with a documented need;
- separate the rights to create, approve, and send sensitive campaigns;
- restrict each API and SMTP key to autorized IP addresses when the architecture allows it;
- prefer OAuth with only the necessary rights for compatible integrations;
- periodically review users, connected applications, senders, and domains;
- trigger alerts for unusual logins, exports, and sending volumes.
In 2026, Brevo supports 2FA via an authentication app or SMS, including with SSO. However, the Cybersecurity and Infrastructure Security Agency recommends phishing-resistant multifactor authentication, especially for administrative access. A physical key or a method cryptographically tied to the service is more resistant than a code received by SMS.
The IP address restrictions offered by Brevo can be configured separately for API and SMTP keys. An API is an interface used by two software programs to communicate; SMTP is the protocol for sending emails. This filtering is particularly relevant for a server with a fixed IP address, but it can be inconvenient for a mobile team or an infrastructure whose addresses change frequently.
For OAuth integrations, Brevo documents detailed read or write autorizations and access tokens valid for one hour in 2026. Honestly, granting full access "just in case" is not a time-saver: it is security debt. The right setting grants only the operations essential to the connector.
Which controls should be chosen based on risk and effort?
The best trade-offs begin with human access, then cover technical credentials and detection. Multifactor authentication and named accounts require little effort. IP restriction and automated secret rotation require more preparation, but sharply limit the possibilities for exploiting a stolen key.
| Control | Addressed risk | Effort (for reference only) | Trade-off |
|---|---|---|---|
| Named accounts and 2FA | Theft or sharing of human access | Low | To be deployed first |
| Minimum privileges | Expired or unauthorized sending | Low to medium | Plan for a regular review |
| IP restriction for keys | Use of a key from an unknown server | Medium | Very effective with fixed IPs |
| OAuth with limited scope | Integration that is too powerful | Medium | Preferred when it is supported |
| Rotation and secret vault | Old key exposed in code | Medium to high | Priority for critical applications |
| Alerts on campaigns and exports | Abuse of an otherwise authorized access | Medium | Essential for quick detection |
The second Brevo incident shows why a fully privileged, long-lasting key should not remain in source code. On September 17, 2026, Brevo said it had replaced it with short-lived Cloudflare tokens with restricted permissions. The company also announced centralized secret storage, automatic rotation, and new alerts for sensitive changes.
On the agency side, the reflex is to map the path of data and secrets before connecting a form, a WordPress site, or a business application. A dependency loaded from a provider can become an attack channel without the email account itself being compromised. This reasoning aligns with the necessary vigilance regarding the cascade effect of NIS2 among subcontractors.
With a limited budget, it is better to have five controls that are actually used than a complex security tool that is never consulted. Start with named accounts, 2FA, removing dormant access, and alerts on sends. Automated rotation and a secret vault become a priority as soon as an email API powers several sites or a business application.
What should you do if an email account is compromised?
After a compromised email marketing account, you must first block active access, then replace all secrets that may have been copied. The Brevo procedure documented in 2026 calls for changing the password, recreating API keys, enabling 2FA, restricting IPs, and regenerating SMTP credentials.
Revoking only the password is not enough. An already open session, a copied API key, or an SMTP credential can continue to work independently. You must also suspend campaigns, review added senders, and look for contact exports or permission changes.
Brevo activity logs record in 2026 logins, user and permission changes, API key operations, domain or sender changes, and 2FA events. They are retained for 90 days on most plans and for 12 months on Enterprise, according to Brevo documentation. Exporting these elements quickly helps avoid losing useful traces.
Next comes the impact analysis: what data was accessed, what messages were sent, and which sites loaded an affected component? If personal data is involved, the company must assess its obligations under RGPD with its data protection officer or counsel. The qualification depends on the facts; it should not be inferred from a simple vendor alert.
Finally, inform recipients with specific instructions if the risk is established: subject of the fraudulent messages, domain used, links to avoid, and official verification channel. Communication that is too vague is of little help. To place the event within a broader response method, the overview on best practices when facing a cyberattack usefully distinguishes confirmed facts, exposure, and compromise.
Defining access, dependencies, and the revocation plan before the incident avoids most improvised decisions. An outside perspective can help connect email marketing configuration, site security, and internal responsibilities without unnecessarily burdening operations.
FAQ on the security of an email marketing platfororm
Is Brevo safe for an SMB in 2026?
Brevo offers useful controls in 2026, including 2FA, detailed permissions, IP restrictions, and activity logs. Security, however, depends on how they are configured, the connected integrations, and the company’s ability to detect and then quickly revoke abnormal access.
How often should an email API key be changed?
An email API key must be replaced immediately after any suspicion of exposure and lors when a provider who could access it leaves. Automatic rotation is preferable for critical systems; the normal frequency must be adapted to the secret’s lifespan and to the possibilities for deployment without interruption.
Is two-factor authentication via SMS enough for emailing?
SMS-based two-factor authentication is preferable to a password alone, but it is less resistant to phishing and SIM swapping. For an administrator account, an authentication app or, better yet, a phishing-resistant multi-factor method further reduces the risk.
Should Brevo forms be removed from a WordPress site?
A Brevo form form should not be automatically deleted because of the September 2026 incident. The scripts loaded must be inventoriedorier, WordPress and its plugins must be maintained, administrator accounts must be limited, and a way to quickly disable an external dependency in the event of an alert must be planned.