Major hedge funds and private equity firms on Wall Street have recently faced a series of cyberattacks. The attacks employed "voice phishing" techniques that mimic voices to extract information from employees. Highly evolving artificial intelligence (AI) tools helped hackers carry out the attacks with ease.
According to Bloomberg on the 5th, hedge fund manager Point72 Asset Management notified investors that day that it had been hit by a hacking attack. The company said, "Initial findings showed no indication that client information had been leaked." Point72 is still reviewing the matter.
Hackers also attempted to break into the information systems of other large hedge funds, including Millennium Management, Two Sigma Investments and Citadel, as well as several private equity firms. Two Sigma, which manages $75 billion, said it blocked attempts to access sensitive data. A Two Sigma official said, "Our security team responded swiftly to voice phishing attempts targeting Two Sigma and other investment management firms, and there is no indication that any data or systems were affected," adding, "We continue to monitor the situation closely."
Wall Street Security Breaches Surge Over Past Year; AI Tools Lower Barrier to Attack
Security breaches on Wall Street have surged over the past year. Vinod Paul, president of Align Managed Services, which supports security and information technology (IT) for hedge funds, noted that AI tools have made cheap and wide-ranging attacks possible. "Whereas targeted attacks previously aimed at 50 firms, now 1,000 is possible," Paul said. "Hackers can eavesdrop on calls and create fake calls by mimicking the speaker's voice, tone and manner of speech."
Google's cybersecurity organization said in a report posted on its blog in June this year that a series of attacks targeting law firms and professional services companies had occurred this year. Voice phishing techniques were used in these attacks as well, and in some cases, attackers impersonated IT staff to physically enter company offices.
The Financial Industry Regulatory Authority (FINRA), which oversees broker-dealers and securities personnel, has reportedly been in contact with member firms regarding the recent breach attempts. In March, FINRA launched a financial intelligence fusion center to share fraud threat information with member firms and coordinate responses.
These incidents demonstrate the growing risk that fraud organizations or rogue states could scale up attacks with advanced technology. Bloomberg explained, "In some cases, ransom is demanded in exchange for releasing data or systems," adding, "Wall Street firms and markets that process trillions of dollars a day could be hit."
This series of attacks occurred at a time when U.S. authorities were struggling to suppress cyberattacks targeting water supply systems in several states. Those water supply attacks raised concerns about a possible connection to Iran. Will Wilson, president of Antithesis, an IT vulnerability assessment firm, cited the specialized and rare nature of the skills and knowledge required to execute attacks as the reason the financial industry has been able to maintain loose software practices for decades. "The frightening thing about modern AI systems is that they have made this a common tool, enabling large-scale attacks," Wilson said. "Everyone needs to raise their game significantly, or they are likely to be in serious trouble."
