Hackers targeted US private equity, other firms including Blackstone, CME, data shows

WASHINGTON, Aug 6 (Reuters) - Ransom-seeking hackers who use phone calls to compromise their victims targeted dozens of prominent U.S. financial institutions and other businesses over the past month, according to Google and internet intelligence data reviewed by Reuters. The data shows the hackers devised websites aimed at stealing passwords from employees of private equity firms and companies including Blackstone BX.N, Bridgewater Associates, Apollo Global Management APO.N, Bain Capital, KKR KKR.N, TPG TPG.O, CME Group CME.O and Moody's MCO.N, as well as a host of financial companies and other businesses. Internet company Google said in a blog post about the hacking campaign published on Thursday that the hackers operate under a range of names, including Redact, Pink, Falcon, and Helix. Google declined to comment on Reuters findings. Its blog said in some cases companies, which it did not name, paid ransoms to the hackers. Reuters could not establish which companies the hackers successfully compromised. Experts say the hackers' use of low-tech tactics such as phone calls to target the financial industry illustrates how, despite sophisticated security programs and AI-driven threats, the oldest tactics still rank among the most effective. If successful, the hacks could compromise data of some of the biggest U.S. private equity firms that provide capital to companies. HACKERS SHIFT ATTENTION: GOOGLE In its blog post, Google — a unit of Alphabet GOOGL.O — said the hackers had recently turned their attention to private equity, law firms, and financial ratings agencies. Austin Larsen, the principal threat analyst at Google’s Threat Intelligence Group, said the hackers generally targeted industries based on financial calculations, often successfully. “Really, it’s a money thing,” Larsen said. “They think that these firms or organizations have data sensitive enough that, if taken, they would pay to prevent it.” Google did not identify any of the hackers’ targets by name. Reuters reverse-engineered many of the company-specific online traps used by the hackers by running the 72 malicious websites Google listed in its report through web intelligence platforms such as DomainTools and urlscan, which flagged malicious subdomains tailored to each firm. Speaking in general about the subdomains, Larsen said "they all were likely used in attempted intrusions" though he cautioned "they were not all successful." Google said the hackers used “meticulous social engineering tactics,” reaching employees on their personal cellphones while pretending to call from their company’s help desk, sometimes displaying the correct help desk phone number. The hackers told their targets there was an urgent directive from IT to update their passkeys or multifactor authentication and steered the employees toward a booby-trapped website with domain names such as “passkeyhelpdesk” or “secure-passkey.” If an employee followed the instructions to enter their password, the hackers would harvest their fail-safe passcode – typically sent by text or generated by an app – live over the phone and hijack their account before the call terminated. Larsen said it was wrong to think of the tactic as particularly advanced. "Sophisticated is not the right word," he said. "It is just really effective." The hacking attempts, a few of which were earlier reported by Bloomberg, have caused a stir on Wall Street. For example, Point72 Asset Management told investors on Wednesday that it had been targeted by hackers, according to a source familiar with the matter. That source – and a second source familiar with the matter – said the hackers had also attempted to breach other hedge funds, including Two Sigma Investments and Citadel, whose names also appeared in the data reviewed by Reuters. Two Sigma and Point72 have not returned messages seeking comment. Citadel declined to comment. A host of other firms were in the hackers’ crosshairs before they pivoted to financial institutions, according to Google's blog post and the data. The data shows that the cybercriminals built digital traps for more than 200 companies in the past five weeks alone, including the ride hailing company Uber UBER.N, online broker Zillow ZG.O, and jeans brand Levi Strauss LEVI.N, as well as several law firms, including Paul Hastings and Greenberg Traurig. Uber, Zillow, Paul Hastings, and Levi Strauss did not immediately return messages seeking comment. In a statement, Greenberg Traurig said it "did not have a data breach given the layers of security protocols we have in place to protect client data and the firm.” It did not elaborate.

Hackers targeted US private equity, other firms including Blackstone, CME, data shows

Hackers targeted private equity and financial firms

Google says the hackers shifted toward financial targets

Wall Street firms and other companies were also targeted

Related News

Regeneron posts transcript of Q2 2026 earnings conference call

Five Star Bancorp Q2 FY26 net income climbs 33.72% to $19.4 million; net interest income rises 26.2% to $46.08 million

GCM Grosvenor Core Absolute Return Master Fund Says $5.4 Mln Interests Validly Tendered

Where Food Comes From May Offer Up To $50 Mln Of Securities

Wabtec CEO Rafael Santana disposes of 2,326 common shares worth $693,262.09