Key Takeaways
- • Two Sigma Investments, the $75 billion quantitative fund, confirmed it was targeted in a voice phishing (vishing) campaign in early August 2026 and that its security team intercepted the attempt before any data or systems were compromised.
- • Citadel and Point72 Asset Management were also on the attackers' target list, but both declined to say whether their defenses were breached; several unnamed private equity firms were also targeted.
- • Attackers used AI voice-cloning technology to impersonate trusted colleagues or executives and pressure employees into surrendering passwords, granting remote access, or sharing sensitive information.
- • FINRA has begun connecting affected firms with threat intelligence through its Financial Intelligence Fusion Center, launched in March, though it declined to comment on the specific incident.
- • No confirmed breaches, stolen data, ransom demands, or financial losses have been publicly disclosed from this campaign.
Summary
Hackers launched a coordinated wave of AI-enabled voice phishing attacks against several of the largest hedge funds in recent days, according to people familiar with the matter. The campaign targeted Two Sigma Investments, Citadel, and Point72 Asset Management, along with several unnamed private equity firms. Two Sigma, which manages approximately $75 billion, confirmed the attempt and said in a statement that its security team "responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems." Citadel, led by Ken Griffin, and Point72, led by Steve Cohen, declined to say whether the hackers breached their defenses. Reported assets under management are approximately $63 billion for Citadel's flagship and $35 billion for Point72, according to recent regulatory filings and media reports.
The attackers used AI-powered sound technology that can listen to phone calls and replicate a speaker's voice, tone, and phrasing. By impersonating trusted colleagues or executives, the cybercriminals sought to manipulate employees into handing over passwords, granting remote access, or sharing other sensitive information. The publisher notes that no confirmed breaches, stolen data, ransom demands, or financial losses have been publicly disclosed from this specific campaign.
FINRA has begun connecting affected firms with threat intelligence through its Financial Intelligence Fusion Center, a channel launched in March for members to share fraud intelligence and coordinate responses to sophisticated threats. A FINRA spokesperson declined to comment on the specific incident but confirmed the regulator has been in contact with the targeted firms. The attacks come amid a broader surge in AI-enabled cybercrime; earlier this year, the White House announced a working group uniting AI developers and critical infrastructure operators to share threat intelligence.
Security experts have long warned that accessible AI speech tools would increase the severity and frequency of scams. In 2024, an employee at the Hong Kong branch of a multinational company wired more than $25.5 million to scammers who used AI-generated deepfakes of company employees, including the chief financial officer. Will Wilson, CEO of IT security firm Antithesis, said AI has "commoditized" hacking capabilities, enabling attacks at scale, and that financial firms previously benefited from the scarcity of hacking expertise. Groups such as "Scattered Spider" have used similar social-engineering techniques to build a large roster of corporate victims over recent years.
The attackers used AI-powered sound technology that can listen to phone calls and replicate a speaker's voice, tone, and phrasing. By impersonating trusted colleagues or executives, the cybercriminals sought to manipulate employees into handing over passwords, granting remote access, or sharing other sensitive information. The publisher notes that no confirmed breaches, stolen data, ransom demands, or financial losses have been publicly disclosed from this specific campaign.
FINRA has begun connecting affected firms with threat intelligence through its Financial Intelligence Fusion Center, a channel launched in March for members to share fraud intelligence and coordinate responses to sophisticated threats. A FINRA spokesperson declined to comment on the specific incident but confirmed the regulator has been in contact with the targeted firms. The attacks come amid a broader surge in AI-enabled cybercrime; earlier this year, the White House announced a working group uniting AI developers and critical infrastructure operators to share threat intelligence.
Security experts have long warned that accessible AI speech tools would increase the severity and frequency of scams. In 2024, an employee at the Hong Kong branch of a multinational company wired more than $25.5 million to scammers who used AI-generated deepfakes of company employees, including the chief financial officer. Will Wilson, CEO of IT security firm Antithesis, said AI has "commoditized" hacking capabilities, enabling attacks at scale, and that financial firms previously benefited from the scarcity of hacking expertise. Groups such as "Scattered Spider" have used similar social-engineering techniques to build a large roster of corporate victims over recent years.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.