Kroll Data Breach Reveals FTX, BlockFi, and Genesis Creditor Information

A recent data breach at financial and risk advisory firm Kroll has exposed the personal information of individuals who had filed credit claims.

Kroll, which manages claims for insolvent companies such as FTX, BlockFi, and Genesis Global Holdco, fell victim to a SIM-swapping attack. Hackers managed to gain access to personal data files of bankruptcy claimants after stealing an employee's phone number.

FTX and BlockFi promptly addressed the situation, clarifying that limited, non-sensitive customer data of specific claimants had been exposed due to unauthorized third-party access on Kroll's systems.

However, both companies affirmed that user passwords and client funds remained unaffected since their own systems weren't directly breached. Kroll assured that it would directly notify the affected individuals and had already taken measures to contain and address the breach.

The breach also triggered a series of phishing attempts. Those related to the crypto firms that were undergoing bankruptcy proceedings reported receiving phishing emails, primarily impersonating FTX. These deceptive emails aimed to extract individuals' cryptocurrency wallet information, particularly their seed phrases, which would allow hackers to empty their victims’ wallets.

The incident shed light on the modus operandi of the breach. Attackers targeted a T-Mobile account belonging to a Kroll employee, exploiting a SIM-swapping attack. This allowed them to breach Kroll's cloud-based systems, gaining access to critical data, including names, addresses, email addresses, and debtor claim details. The breach appeared to be isolated to the crypto investment companies under bankruptcy proceedings – BlockFi, FTX, and Genesis – with no evidence of lateral movement within Kroll's systems.

Kroll has stated its commitment to cooperating with authorities and conducting an internal investigation.

Meanwhile, FTX and BlockFi temporarily suspended accounts of affected users accessing their claims portal as a precautionary measure. Both companies reassured users that their claim data submitted through the Kroll customer claims portal remained secure and valid.