FTX Creditors Sue Kroll Over Data Breach Exposing Sensitive Info

FTX creditors have initiated a class-action lawsuit against Kroll Restructuring Administration, the firm responsible for managing claims from the collapsed cryptocurrency exchange, over allegations of data mishandling that led to a 2023 breach. The breach reportedly exposed sensitive information, including names, addresses, email contacts, and FTX account balances, leaving creditors vulnerable to phishing attacks and financial harm [1]. The lawsuit, filed on August 20, 2025, criticizes Kroll for its reliance on email communication for critical notices, despite prior warnings about phishing risks [2].

According to the complaint, unauthorized access to a Kroll employee’s mobile number allowed hackers to infiltrate the firm’s cloud systems, raising serious questions about the adequacy of its data security protocols [3]. The legal action highlights several procedural failures, including delays in claim verification, inconsistent account statuses, and difficulties in submitting required tax forms [4]. These issues have exacerbated the challenges faced by creditors attempting to recover their assets.

The plaintiffs are seeking financial compensation for victims of phishing attacks and delayed claims, alongside systemic reforms to Kroll’s claim management processes. Proposed changes include the implementation of multi-channel communication using both email and traditional mail, mandatory response periods for status updates, and the introduction of manual tax-form upload options independent of KYC verification [3]. Additional demands include stricter security controls for account modifications and independent audits of Kroll’s data protection practices.

Nicholas Hall, the lead attorney representing the creditors, emphasized that the reforms are essential to prevent future breaches and restore trust in the claims process. “The class-action lawsuit is a necessary step to hold Kroll accountable for their mishandling of sensitive claims data, which has left our clients vulnerable to ongoing threats,” he stated [1]. FTX creditor and community advocate Sunil Kavuri also confirmed the persistent threat of phishing emails, noting that he received a fraudulent message containing his personal details shortly after discussing the issue [2].

The lawsuit also highlights issues with the claims portal, where creditors have reported difficulties in submitting tax forms and experiencing inconsistent verification statuses. These problems have contributed to widespread frustration, particularly as the third round of FTX reimbursements—worth $1.9 billion—is scheduled for September 30, 2025 [4]. The potential for exploitation by scammers has heightened during this period.

The case raises broader concerns about the responsibility of third-party administrators in securing sensitive data during financial restructurings. As the FTX case continues, it serves as a cautionary example of the risks associated with inadequate cybersecurity measures in the cryptocurrency industry [1]. The potential outcomes include financial compensation for eligible creditors, operational reforms at Kroll, and enhanced security protocols to prevent future data breaches.

Source: [1] FTX creditors sue Kroll for mishandling claims, exposing sensitive data (https://cryptoslate.com/ftx-creditors-sue-kroll-for-mishandling-claims-exposing-sensitive-data/) [2] Kroll faces class-action suit as FTX creditors allege daily scam emails (https://cointelegraph.com/news/kroll-class-action-ftx-creditors-complain-daily-scam-emails) [3] FTX Creditors Launch Legal Battle Against Kroll for Mishandling Claims (https://coingape.com/trending/ftx-creditors-launch-legal-battle-against-kroll-for-mishandling-claims/) [4] FTX creditors sue Kroll for mishandling claims, exposing sensitive data (https://cryptoslate.com/ftx-creditors-sue-kroll-for-mishandling-claims-exposing-sensitive-data/)