Trezor confirmed attackers used a compromised third-party email provider to blast out fake STM32 security alerts to wallet holders. Your hardware wallet's seed being offline means nothing if a phishing email tricks you into acting on it. Rule of thumb: never trust urgent security emails, always verify through official channels before clicking anything.