Wall Street Just Got Hit: Hedge Funds Face a New AI-Driven Cyber Squeeze

Hedge funds and money managers are back in the crosshairs

Recent attempts targeted major money managers, including Two Sigma, Citadel and Point72, while several private equity firms were also targeted. What makes this notable is not just the sector under attack, but the scale: these are highly connected firms whose disruption can reverberate through trading, operations, and counterparty confidence.

The reported method matters too. The campaign used voice phishing, or vishing, in which attackers mimic voices on phone calls or messages to push victims into revealing credentials or granting access. That shifts the exploit beyond code and into human trust, with AI potentially making those attacks easier to scale.

Two Sigma said it thwarted the attempt to access sensitive data and saw no indication of impact to its data or systems. That is good news in the short run, but it does not reduce the broader warning sign: if AI-enabled vishing can reach large asset managers, the threat is operationally meaningful even when no breach is confirmed.

The wider backdrop is a more hostile cyber environment

The Two Sigma headline may be recent, but the underlying pressure is broader. FINRA has already warned that cyberattacks and outages at third-party providers are rising, while a third-party summary of FINRA's 2026 oversight report says cyber risk in the financial industry continues to escalate with more sophisticated attacks and emerging threats from GenAI and cybercrime-as-a-service.

Third-party exposure is now part of the core risk story

The larger issue is not one incident alone. Black Kite says ransomware incidents climbed from 156 to 202 in 2025, a 30% year-over-year increase. Its report also argues that the vendor layer financial firms depend on has become materially riskier, with critical vulnerabilities in vendors rising alongside direct attacks. That matters because markets often price the recovery after disruption, not the buildup before it.

Shared vendors can turn one breach into many

The cascading potential is already visible in recent cases. Black Kite says Qilin's compromise of a single South Korean MSP spread to 32 financial institutions and more than 2 terabytes of stolen data. Separately, activity associated with Seedworm has continued in recent days, including suspicious activity on the network of a U.S. bank. Those examples support a broader point: weak spots in shared technology providers can expose many firms at once.

Why this matters now

FINRA's guidance makes clear that an attempted cyberattack or outage at a third-party provider could potentially impact a large number of member firms. That is why the practical takeaway is less about a single headline and more about vendor-risk controls, identity hygiene, and incident readiness. The market starts paying attention before the next outage lands, not after.