Kroll Faces Class-Action Lawsuit Over Data Breach Impacting FTX Creditors

Highlights:

• Kroll is facing a class-action lawsuit as creditors say a breach exposed data and led to daily phishing attacks.
• FTX customer Jacob Repko lost 1.9 ETH after a phishing attempt linked to the Kroll data breach.
• The plaintiffs demand that Kroll improve communication by adding mailed notices and manual tax form uploads for creditors.

Financial and risk advisory firm Kroll is facing heightened scrutiny after a lawsuit linked to a data breach was filed this week. The case was filed in a US district court by Hall Attorneys on behalf of FTX customer Jacob Repko and other creditors.

BREAKING: Kroll faces class-action lawsuit over its Aug 2023 data breach.

Filed by FTX creditor Jacob Repko & others, the suit alleges leaked data led to relentless phishing targeting crypto claimants — some hit with scams almost daily.

If successful, victims may… pic.twitter.com/x9lsrdqLUJ

— CoinRank (@CoinRank_io) August 22, 2025

The court documents reveal that the hackers used the mobile phone number of a Kroll employee to access the Kroll systems in the cloud. The attackers secured files containing sensitive data such as customer names, email addresses, home addresses, and account balances related to FTX accounts.

Kroll acknowledged the breach in a notice to creditors. The firm said no FTX passwords or digital assets were exposed, but it warned that personal data could be used in phishing attempts. The company also stated that its broader systems and client funds were not impacted by the incident. The lawsuit, however, argues that the compromised data has placed creditors at risk and caused direct financial losses. It claims that the incident revealed weaknesses in how Kroll handled creditor information.

Creditors Report Losses and Ongoing Phishing Attempts

Since the breach, creditors have reported persistent phishing attacks. Sunil Kavuri, a creditor and activist, said that he has received fraudulent emails almost every day. He posted screenshots showing his name included in messages that sought to trick him into revealing sensitive details. Kavuri also shared records of multiple phishing attempts received between August 14 and the following Sunday. Other creditors responded that they, too, had received similar emails.

FTX Creditors now daily receive scam emails impersonating FTX, Bahamas. Just received one few hours ago

Full name is included

Nicholas has filed a class action for the alleged data breach at Kroll https://t.co/kILxhygv90 pic.twitter.com/GcpEn2pu1I

— Sunil (FTX Creditor Champion) (@sunil_trades) August 21, 2025

Repko, the lead plaintiff, told the court he personally lost 1.9 ETH in July 2025. The funds were stolen after a phishing attack redirected money he was transferring to his digital wallet. The filing also highlighted problems with the FTX Customer Claims Portal. Repko explained that his Know Your Customer status kept changing between “Verified” and “On Hold/Unverified.” Because of this, he was unable to upload the required tax forms needed for reimbursement.

The lawsuit stated that creditors could miss out on payments if tax forms are not submitted in a timely manner. The lawsuit also slammed Kroll for relying solely on email to facilitate key processes, which plaintiffs argue left users exposed throughout and after the breach.

Kroll Faces Class-Action Lawsuit Seeking Compensation and Changes

The case against Kroll is looking at both monetary compensation and institutional change to ensure such an event never happens again. Nicholas Hall, lead counsel for the plaintiffs, said in a statement that the case represents a servicing failure. “After a known security incident and impersonation wave, you can’t run deadlines on email-only and offer no mailed confirmations or manual fallback,” Hall explained. He added that eligible participants might receive monetary compensation if the court rules in their favor.

The dispute comes as FTX creditors prepare for their next round of reimbursements. The third phase, amounting to $1.9 billion, is scheduled to begin on September 30. However, the distribution will exclude foreign creditors from restricted regions, including China and Russia. More than $5 billion was already distributed in the second round, announced in May. Earlier this year, FTX also detailed plans to distribute $1.2 billion to users with claims up to $50,000.