Customer
data of bankrupt crypto exchange, FTX, and insolvent digital asset lenders
BlockFi and Genesis, were exposed earlier this month, Kroll, the vendor responsible
for overseeing creditor claims for the insolvent businesses, confirmed
today (Friday).
In a
statement, Kroll explained that the hack was the result of a “highly
sophisticated SIM swapping attack” targeted at the T-Mobile US account of one
of its employees. T-Mobile is a mobile network operator.
A SIM
swapping attack is a type of phone fraud in which a hacker deceives a mobile
service provider into redirecting their target’s phone number to a SIM card
they control. This grants the hacker access to the victim’s incoming text
messages and calls, including those used for two-factor authentication (2FA).
“As a
result [of the attack], it appears the threat actor gained access to certain
files containing personal information of bankruptcy claimants in the matters of
BlockFi, FTX and Genesis,” Kroll stated in the statement, adding that it acted
immediately “to secure the three affected accounts.”
The bankruptcy
claims vendor added that it had informed affected customers of
the attack via email. In addition, the firm, which is also a prominent risk and
financial advisory solutions provider, said it is cooperating with the US
Federal Bureau of Investigation (FBI) and “a full investigation is underway.”
“We have no
evidence to suggest other Kroll systems or accounts were impacted,” Kroll
added.
FTX and
BlockFi Respond
In
different posts on social media platform X (formerly known as Twitter), FTX and
BlockFi also confirmed the attack. However, FTX noted that the
information comprised was “non-sensitive” customer data of certain
claimants in its pending
bankruptcy case.
“FTX
account passwords were not maintained by Kroll, and FTX’s own systems were not
affected,” the cryptocurrency exchange said, adding that it is “closely
monitoring the situation.” Furthermore, FTX urged its customers to
“remain on high alert for attempted fraud and scam emails impersonating parties
in the bankruptcy.”
(1/3) FTX learned that Kroll, the claims agent in the bankruptcy, experienced a cybersecurity incident that compromised non-sensitive customer data of certain claimants in the pending bankruptcy case.
— FTX…
