Kroll Breach: When Your Bankruptcy Trustee Becomes a Phisher's Best Friend

The Irony Is Painful

Imagine you've already lost your shirt in a crypto bankruptcy. Now, the very company hired to give you your money back hands your personal data to scammers on a silver platter. That's exactly what happened with Kroll, the restructuring firm managing claims for FTX and BlockFi creditors.

In August 2023, Kroll disclosed a data breach affecting users of its claims portal. The attackers got names, addresses, email addresses, and claim details—basically a ready-made phishing list. And they're using it.

Featured Snippet: What Happened in the Kroll Data Breach?

Kroll, a third-party administrator for FTX and BlockFi bankruptcy cases, suffered a data breach in August 2023. Attackers accessed personal information of creditors, including names, addresses, and claim amounts. This data is now being used for targeted phishing attacks against desperate victims.

Why This Breach Is a Perfect Storm

First, the victims are already vulnerable. They've lost money and are anxious about recovery. Second, the data is highly specific—scammers know exactly how much each person is owed. Third, Kroll's role as a trusted intermediary means victims are more likely to click a link that looks like it's from them.

It's like getting your wallet stolen, then having the police officer who's supposed to help you sell your address to the thief. Reading the terms and conditions of bankruptcy filings is about as fun as cleaning grout with a toothbrush, but this breach makes it personal.

How the Scams Work

Victims report receiving emails that appear to be from Kroll or the bankruptcy court, asking them to verify their identity or click a link to receive their payout. The links lead to fake portals that steal login credentials or install malware.

Some scammers even call victims, using the leaked data to sound legitimate. They know your claim number, your address, and how much you're owed. It's social engineering at its finest—and most cruel.

What You Can Do Right Now

• Don't click links in unsolicited emails. Always type the official URL directly into your browser.
• Enable two-factor authentication on your claims portal account if available.
• Verify any communication by contacting Kroll or the bankruptcy court through official channels.
• Monitor your credit for signs of identity theft.

For more on data breach notification laws, see the GDPR (though Kroll's breach may fall under US state laws).

FAQ