Brevo Supply‑Chain Breach May Have Compromised Over 100,000 Websites

A malicious intrusion into the French marketing platform Brevo – previously known as Sendinblue – has been linked to a supply‑chain attack that potentially injected malware into more than 100,000 customer sites.

According to the initial report, attackers gained unauthorized access to Brevo's Cloudflare configuration. By manipulating the content‑delivery network, they were able to insert malicious code into the webpages of Brevo's clients, many of which rely on the service for email marketing, transactional messaging and other customer‑engagement tools.

Brevo, which counts major brands such as eBay and luxury retailer Louis Vuitton among its users, provides a cloud‑based suite that allows businesses to embed tracking scripts and other assets directly from its servers. When the compromised Cloudflare settings were active, any website that loaded Brevo-hosted resources could have been served the injected payload without the site owners' knowledge.

Security researchers estimate that the attack may have affected upwards of 100,000 domains, although the exact number remains uncertain pending further investigation. The malicious code appears to have been designed to harvest visitor data and potentially deliver additional payloads, a pattern seen in recent supply‑chain compromises across the web ecosystem.

The breach underscores the growing risk posed by third‑party service providers. Supply‑chain attacks exploit the trust that organizations place in external platforms, allowing threat actors to reach a large number of victims through a single point of failure. In this case, the attackers targeted the CDN layer, a common vector because it sits between the provider's servers and the end‑user's browser.

Brevo has confirmed that it is working with Cloudflare and independent security firms to remediate the vulnerability and to assess the full scope of the intrusion. The company has reset the affected Cloudflare credentials, deployed additional monitoring, and is notifying clients of steps they should take to verify the integrity of their sites.

Industry experts advise website operators who use Brevo or similar services to review recent changes to their source code, scan for unexpected scripts, and consider implementing Subresource Integrity (SRI) checks where feasible. Updating passwords, enabling multi‑factor authentication on third‑party accounts, and maintaining regular backups are also recommended best practices.

While no public disclosures have yet linked the breach to data theft or financial loss, the potential for widespread credential harvesting remains a concern. Authorities in France and other jurisdictions have been alerted, and a coordinated response is expected as more details emerge.

The incident adds to a growing list of high‑profile supply‑chain attacks that have targeted cloud services, reminding businesses that security responsibilities extend beyond the perimeter of their own networks to the ecosystems they depend upon.