Trezor has warned customers not to click links in a fraudulent security email sent after a third-party provider was breached.