Kroll kroll.com Kroll data breach 2023: what happened and what to do
On August 19, 2023, an attacker took over a Kroll employee's phone number in a SIM swap and reached claimant files for the FTX, BlockFi and Genesis bankruptcies. Names, emails, addresses and account balances were among the data. Kroll says passwords weren't affected.
View all 13,177 breaches- Breach date
- 19 Aug 2023
- Data exposed
- Names, Email addresses, Physical addresses, Phone numbers, Account balances
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Kroll is the claims agent in several crypto bankruptcies. It says an unauthorized third party gained control of a Kroll employee's mobile phone number on or about August 19, 2023, in a SIM swapping attack. The attacker then reached files stored in Kroll's cloud systems.
What was exposed
For FTX claimants, Kroll lists name, email address, mailing address, FTX account number, a bankruptcy identifier, account balance, phone number and other claim details. For a limited number of people, a date of birth was also affected. Kroll says passwords weren't affected and that FTX's systems and digital assets weren't involved. For Genesis claimants, it describes files with name, address, email address and claim details. Kroll first sent notices on August 25, 2023, and a second round on November 2, 2023, after the scope grew. No total count of people affected is given in the notices.
What it means
The practical risk is targeted phishing. Scammers who know your claim and balance can pose as the bankruptcy administrator and push you to a fake site. News coverage reported phishing messages impersonating FTX that tried to get wallet seed phrases.
A seed phrase is the master key to a crypto wallet. No legitimate claims process asks for it.
Sources checked: ftxquestions.kroll.com, genesisquestions.kroll.com, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Never share a seed phrase or wallet password
No bankruptcy administrator or exchange needs your seed phrase. Treat any message asking for it as a scam.
- 2
Go to claims sites yourself
Don't click links in emails or texts about your claim. Type the official address or use the one on your original notice.
- 3
Protect your phone number
A SIM swap moves your number to the attacker's phone. Ask your carrier about a number lock or port-out PIN, and use an authenticator app instead of SMS codes where you can.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone appears in this and other breaches. Serus can't remove breach data, but it alerts you when your details show up in a new one.
- 5
Report misuse
If someone uses your details, report it at IdentityTheft.gov to get a personal recovery plan.
Frequently asked
Was I affected by the Kroll breach?
Kroll notified affected claimants of the FTX and Genesis bankruptcies. Claimants who filed on or before August 19, 2023 were among those contacted. Check your email for the notice.
What was exposed?
Names, emails, addresses, account numbers and balances, with dates of birth for a limited number of FTX claimants. Kroll says passwords weren't affected.
Should I change my password?
Kroll says passwords weren't affected. Do secure the email and phone number tied to your claim.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
