Key Takeaways
- • Four major hedge funds targeted: Citadel, Point72 Asset Management, Two Sigma Investments, and Millennium Management were hit in a coordinated wave of AI-powered voice phishing ("vishing") attacks, with several private equity firms also targeted in the same assault.
- • AI voice cloning exploited for credential theft: Attackers used artificial intelligence to clone or mimic employee voices in phone calls, attempting to extract sensitive credentials and system access from financial services workers.
- • Limited data breach confirmed: Point72 informed investors that despite being attacked, initial review found no client information was stolen, though the firm stated it was still reviewing the incident.
- • Two Sigma blocked breach successfully: Two Sigma, which manages $75 billion in assets, reported that its security team responded quickly and blocked the attempted vishing campaign with no indication of impact to data or systems.
- • FINRA coordination underway: The Financial Industry Regulatory Authority (FINRA) engaged with member firms regarding the breaches and leveraged its newly launched Financial Intelligence Fusion Center (established March 2026) to coordinate threat intelligence sharing and response coordination.
Summary
A coordinated wave of sophisticated cyberattacks utilizing artificial intelligence voice cloning targeted several of Wall Street's largest hedge funds in early August 2026. Citadel, Point72 Asset Management, Two Sigma Investments, and Millennium Management were all compromised in the campaign, which also extended to multiple private equity firms. The attackers employed "vishing"—voice phishing attacks that use AI technology to clone or mimic voices during phone calls—to attempt extraction of sensitive employee credentials and system access.
Point72 Asset Management disclosed the attack to investors on Wednesday, August 5, 2026, confirming that initial review indicated no client information had been stolen. However, the firm noted it was continuing its investigation into the incident. Two Sigma Investments, which manages $75 billion in assets under management, successfully blocked the attempted breach. A Two Sigma spokesperson stated: "Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems. We continue to monitor the situation closely."
Spokespeople for Millennium Management, Point72, and Citadel declined to comment to Bloomberg regarding the attacks. The vishing methodology exploited employee trust to gain unauthorized access to critical systems—a technique that represents an escalation in the sophistication of cyber threats targeting the financial services industry.
Regulatory authorities responded promptly to the threat. FINRA maintained contact with member firms regarding the attempted breaches and activated its Financial Intelligence Fusion Center, launched in March 2026, to facilitate secure sharing of fraud threat intelligence and coordinate industry-wide response efforts. This coordination mechanism reflects growing recognition of the need for real-time threat intelligence distribution across regulated financial institutions facing increasingly sophisticated AI-enabled attack vectors.
Point72 Asset Management disclosed the attack to investors on Wednesday, August 5, 2026, confirming that initial review indicated no client information had been stolen. However, the firm noted it was continuing its investigation into the incident. Two Sigma Investments, which manages $75 billion in assets under management, successfully blocked the attempted breach. A Two Sigma spokesperson stated: "Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems. We continue to monitor the situation closely."
Spokespeople for Millennium Management, Point72, and Citadel declined to comment to Bloomberg regarding the attacks. The vishing methodology exploited employee trust to gain unauthorized access to critical systems—a technique that represents an escalation in the sophistication of cyber threats targeting the financial services industry.
Regulatory authorities responded promptly to the threat. FINRA maintained contact with member firms regarding the attempted breaches and activated its Financial Intelligence Fusion Center, launched in March 2026, to facilitate secure sharing of fraud threat intelligence and coordinate industry-wide response efforts. This coordination mechanism reflects growing recognition of the need for real-time threat intelligence distribution across regulated financial institutions facing increasingly sophisticated AI-enabled attack vectors.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.