What happened? It appears that on or about Saturday, August 19, 2023, an attacker conducted a SIM swapping attack against T-Mobile US and gained control of a mobile phone number belonging to an employee of Kroll Restructuring Administration LLC (“Kroll”), the Claims Agent for the BlockFi bankruptcy proceeding. As a result, the attacker appears to have accessed files stored online in Kroll’s cloud-based systems, including files that contained information about BlockFi claimants. When Kroll became aware of the incident, it acted quickly to secure the Kroll employee account and launched an investigation. This attack on T-Mobile and Kroll did not affect any BlockFi systems or BlockFi digital assets.