Curriculum·G705 Scam Response for Community Leaders·about 31 min
After: the second wave and the postmortem
By the end of this lesson you can
- →State what happened in the Kroll breach of August 2023, whose data was exposed, how, and what followed within days
- →Explain why an incident's data becomes the next incident's target list, and why the postmortem has to cover the second wave as well as the first
- →Compute the second-wave exposure of a creditor population from the breach's own scope, and read what the phishing that followed was worth
- →Write a postmortem the Academy's way: the timeline, the cause stated as a decision point, the changes, what members can verify, and what remains unknown
Graduate · enrolled learners
This lesson opens with The Kroll SIM-swap breach, 19 August 2023.
- What happened
- Kroll, the claims agent handling the bankruptcies of FTX, BlockFi and Genesis, reported that on 19 August 2023 an attacker had transferred a Kroll employee's phone number to their own device through the employee's carrier, T-Mobile, without any authority from or contact with Kroll or the employee. With the number, the attacker accessed files containing personal information of creditors of the three bankrupt platforms. For FTX customers that included names, addresses, email addresses and account balances; for Genesis creditors, names, addresses, email addresses and claim details; BlockFi described its exposed data as limited and non-sensitive. FTX and BlockFi said passwords and client funds were not affected because their own systems were not breached. On the same day as Kroll's notices, FTX creditors reported phishing emails telling them they had been identified as eligible to begin withdrawing digital assets from their FTX accounts, and Kroll warned claimants not to share passwords, seed phrases or private keys.
- The decision point
- The breach exposed no money. It exposed a list: who had lost how much to which collapse, with the email address each of them would open a message about it at. That list is worth more to an attacker than any single wallet, because per G704-04 a person who has lost money is the easiest person to sell recovery to, and the phishing that arrived the same day offered withdrawals matching the victims' last known balances. A postmortem that ends at the first incident has not accounted for the thing the first incident produced. The Academy's postmortem form covers both: what happened, what it produced, what changed, what members can verify, and what is still not known.
What you will be able to answer
- →What happened in the Kroll breach?
- →Why is an incident's data the next incident's target list?
- →The postmortem's six parts?
- →What makes a postmortem an autopsy?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/
- https://www.bleepingcomputer.com/news/security/kroll-data-breach-exposes-info-of-ftx-blockfi-genesis-creditors/
- https://www.helpnetsecurity.com/2023/08/28/kroll-sim-swapping-attack/
Confidence high·Volatility low·Reviewed 2026-09-14·Owner unassigned
Contested
Kroll did not publish the number of creditors whose data was accessed; the lesson's worked example uses an illustrative fraction, labeled as such. Losses from the phishing that followed were not aggregated in any public source the lesson could find.
The lesson uses a claims agent rather than a community because it is the cleanest documented case of a breach whose only product was a target list. The structure is identical for a community incident thread.