"FTX Creditors Sue Kroll: Faulty Email System Fuels Phishing Wave"

FTX creditors have initiated a class-action lawsuit against Kroll, a financial and risk advisory firm, alleging negligence in managing a data breach that exposed sensitive personal information in August 2023. The breach is said to have led to increased phishing attacks targeting creditors from FTX, BlockFi, and Genesis. The lawsuit, filed by Hall Attorneys on behalf of FTX customer Jacob Repko and other creditors, claims that Kroll's reliance on email-only communication and a flawed claims verification process created vulnerabilities that were exploited by cybercriminals [1].

According to the filing, the data breach resulted in creditors being inundated with phishing emails designed to mimic legitimate communications from FTX and other institutions. Prominent FTX creditor Sunil Kavuri reported receiving multiple such emails daily, including one that included his name to increase the legitimacy of the message. Kavuri shared screenshots showing a series of scam emails received from August 14 to a later date, with other users confirming similar experiences [2]. Nicholas Hall, attorney at Hall Attorneys, stated that eligible creditors could potentially receive monetary compensation depending on the court’s ruling and that the case could result in operational changes at Kroll [1].

The lawsuit further argues that the compromised claims verification process not only led to phishing risks but also delayed or prevented some creditors from receiving rightful reimbursements. The plaintiffs seek both damages and a resolution to the communication method currently used by Kroll, which they claim is a single point of failure. This issue is compounded by the fact that Kroll has previously suffered a data breach in March 2025, where hackers accessed client invoicing, accounts payable, and email addresses [1].

Meanwhile, FTX is preparing for a third round of reimbursements to creditors, which is scheduled to begin on September 30 and is expected to distribute $1.9 billion. This follows two earlier rounds, with the second disbursing over $5 billion in May and the first providing $1.2 billion to users with claims under $50,000. However, the latest payout is expected to exclude foreign creditors from restricted countries, including those from China and Russia [2].

The lawsuit underscores growing concerns around data security in the crypto sector, particularly in the context of bankruptcy and claims management. The case could set a precedent for how data is handled in similar situations, especially where a single point of communication is used for large-scale financial operations. If successful, it could also influence Kroll’s internal protocols and broader industry practices regarding customer data protection [1].

Source: [1] Kroll faces class-action suit as FTX creditors allege daily scam emails (https://cointelegraph.com/news/kroll-class-action-ftx-creditors-complain-daily-scam-emails) [2] FTX Creditors File Class-Action Against Kroll Over Data ... (https://www.cryptotimes.io/2025/08/22/ftx-creditors-file-class-action-against-kroll-over-data-breach/)