Key Takeaways
- • Major hedge funds targeted: Point72 Asset Management, Citadel, Two Sigma Investments, and Millennium Management were all targeted in a coordinated wave of AI-powered voice phishing (vishing) attacks in a recent incident reported in August 2026.
- • Two Sigma confirmed no breach; Point72 reviewing: Two Sigma, which manages $75 billion in assets, successfully blocked the attempted vishing campaign with no indication of data or system impact. Point72 informed investors it had been attacked but found no evidence of client information theft during initial review.
- • AI voice cloning as attack vector: Hackers used artificial intelligence technology to clone or mimic voices in phone calls, attempting to trick employees into surrendering credentials or granting system access—a technique known as vishing in cybersecurity terminology.
- • Regulatory coordination underway: FINRA has engaged with member firms regarding the breaches and is leveraging its Financial Intelligence Fusion Center, launched in March 2026, to facilitate secure threat intelligence sharing and coordinated responses across the industry.
- • Broader attack scope: The coordinated campaign extended beyond hedge funds, with several private equity firms also targeted as part of the same assault wave.
Summary
A coordinated wave of AI-powered voice phishing attacks targeted some of Wall Street's largest asset managers in recent days, demonstrating the evolving sophistication of cyber threats against institutional financial firms. Point72 Asset Management, Citadel, Two Sigma Investments, and Millennium Management were all targeted, according to reports confirmed by Bloomberg on Wednesday, August 7, 2026. The attackers employed artificial intelligence voice cloning technology to impersonate trusted voices and attempt to extract sensitive data from employees.
Two Sigma, managing $75 billion in assets, reported that its security team responded quickly to the attempted vishing campaign and successfully blocked the attack with no indication of impact to data or systems. "Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems," the firm stated. Point72 notified investors of the attack but indicated in its initial review that no client information had been stolen, though the firm was continuing its investigation at the time of reporting. Spokespeople for Millennium, Point72, and Citadel declined to comment to Bloomberg beyond these acknowledgments.
Vishing—a portmanteau of voice and phishing—represents a significant expansion of traditional phishing tactics by leveraging AI voice technology. Rather than relying on written emails or text-based social engineering, attackers use AI to clone voices or mimic trusted internal personnel, then contact employees by phone to trick them into surrendering credentials or granting system access. This method exploits the trust and urgency conveyed through voice communication, making it substantially more difficult to detect than conventional phishing attempts.
The Financial Industry Regulatory Authority (FINRA) has been actively monitoring the situation and coordinating with member firms regarding the attempted breaches. The regulator is leveraging its newly established Financial Intelligence Fusion Center, launched in March 2026, to facilitate secure sharing of fraud threat intelligence among member firms and enable coordinated defensive responses. The attack campaign extended beyond hedge funds, with multiple private equity firms also targeted as part of the same coordinated assault.
Two Sigma, managing $75 billion in assets, reported that its security team responded quickly to the attempted vishing campaign and successfully blocked the attack with no indication of impact to data or systems. "Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems," the firm stated. Point72 notified investors of the attack but indicated in its initial review that no client information had been stolen, though the firm was continuing its investigation at the time of reporting. Spokespeople for Millennium, Point72, and Citadel declined to comment to Bloomberg beyond these acknowledgments.
Vishing—a portmanteau of voice and phishing—represents a significant expansion of traditional phishing tactics by leveraging AI voice technology. Rather than relying on written emails or text-based social engineering, attackers use AI to clone voices or mimic trusted internal personnel, then contact employees by phone to trick them into surrendering credentials or granting system access. This method exploits the trust and urgency conveyed through voice communication, making it substantially more difficult to detect than conventional phishing attempts.
The Financial Industry Regulatory Authority (FINRA) has been actively monitoring the situation and coordinating with member firms regarding the attempted breaches. The regulator is leveraging its newly established Financial Intelligence Fusion Center, launched in March 2026, to facilitate secure sharing of fraud threat intelligence among member firms and enable coordinated defensive responses. The attack campaign extended beyond hedge funds, with multiple private equity firms also targeted as part of the same coordinated assault.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.