Cybercriminals Target Major U.S. Financial Firms in Vishing Extortion Campaign Google’s security researchers revealed on Thursday that unidentified hacking groups are actively breaching large U.S. financial and investment firms to steal sensitive data and extort victims by threatening to leak it. Among the targeted organizations are prominent private equity firms, including Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. The attackers tracked by Google under the names Falcon, Helix, Pink, and Redact employ voice phishing (vishing), a social engineering tactic where hackers impersonate coworkers or IT support over phone calls to trick employees into divulging credentials and multi-factor authentication codes on spoofed websites. Some groups operate dedicated leak sites to pressure victims into paying ransoms, with one site stating that data publication is a "consequence of refusal to engage." Google’s report suggests these groups may operate under a larger collective, UNC6671, though their exact relationships whether affiliates, splinter factions, or users of a shared Phishing-as-a-Service infrastructure remain unclear. The researchers speculate the groups may compartmentalize operations to obscure breach volumes and isolate negotiation risks. Beyond financial firms, the hackers have previously targeted manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality sectors, seeking intellectual property, source code, and VIP client data. Their recent focus on legal and financial organizations particularly those involved in mergers, acquisitions, and litigation appears strategic, aiming to exploit high-value corporate data for maximum extortion leverage. Financially, the groups have seen success: one cryptocurrency wallet linked to the operation received $10 million in Bitcoin in early 2024, with ransom demands typically ranging from $750,000 to $3 million per victim. Representatives for CME Group declined to comment, while the other named firms did not respond to inquiries.

Bain Capital Discloses Data Breach Affecting Personal and Financial Information Boston-based private investment firm Bain Capital LP reported a data breach after detecting unauthorized access to a cloud storage platform used by the company. The incident was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on September 1, 2026, with affected individuals notified via mail. The breach was discovered on July 28, 2026, when Bain Capital identified unauthorized access to a subset of folders within its cloud storage environment. An investigation revealed that the compromised files contained personal information, including names, Social Security numbers, and financial account details, belonging to a limited group of individuals. While the breach exposed sensitive data, Bain Capital confirmed that no products, services, or operational activities were impacted. The incident was isolated to specific folders and did not affect the firm’s broader investment or business functions. In response, Bain Capital is offering two years of free credit monitoring and identity protection services through IDX to affected individuals. Those impacted must enroll by November 27, 2026, using a personal code provided in their notification letter. For further inquiries, individuals can contact Bain Capital’s Investor Relations via phone, email, or mail.

PowerSchool and Bain Face Legal Setback in Data Breach Lawsuit A California federal judge has partially denied motions to dismiss a lawsuit against PowerSchool Holdings Inc. and Bain Capital, allowing data breach claims from individual users and school districts to proceed. The plaintiffs allege that after Bain’s merger with PowerSchool, the company offshored cybersecurity functions to contractors, leading to vulnerabilities that exposed sensitive data. The lawsuit centers on a cyber incident affecting nearly 50 million individuals, with claims that the offshoring of data-management tools enabled vendors to bypass consent protocols and access protected school district systems. The ruling, issued on Wednesday in the U.S. District Court for the Southern District of California, rejects Bain’s attempt to fully dismiss the case, signaling potential legal and financial repercussions for the companies involved. The decision underscores growing scrutiny over third-party cybersecurity risks and corporate accountability in large-scale data breaches. Further proceedings will determine liability and potential damages.

Bain Capital Faces Legal Action Over PowerSchool Data Breach, Setting Precedent for Private Equity Liability A federal judge in California has allowed a lawsuit against Bain Capital to proceed, marking a potential turning point in holding private equity (PE) firms accountable for cybersecurity failures at acquired companies even those predating the acquisition. The case stems from a massive data breach at PowerSchool, a K-12 education software provider, which exposed the personal data of 60 million students and 10 million teachers across North America. ### The Acquisition and Breach Timeline Bain Capital acquired PowerSchool in a $5.6 billion deal that closed on October 1, 2024, following negotiations that began in August 2022. However, the breach originated before the acquisition in August 2024, when a threat actor used stolen vendor credentials to infiltrate PowerSchool’s systems. Initial data exfiltration from a single school district occurred in September 2024, but the full scope of the breach went undetected until December 28, 2024, when the hacking group ShinyHackers demanded a ransom. The stolen data transferred to a cloud provider in Ukraine included Social Security numbers, medical records, financial details, addresses, disability records, and custody information. PowerSchool publicly disclosed the breach on January 7, 2025, prompting multiple class-action lawsuits. ### Legal Ruling and Allegations Against Bain On March 18, 2026, the U.S. District Court for the Southern District of California ruled that claims against Bain could proceed, rejecting the firm’s motion to dismiss. The court found sufficient evidence to support allegations that Bain: - Ratified cost-cutting measures that included layoffs of domestic cybersecurity staff. - Held pre-closing veto rights over major expenditures, vendor contracts, and workforce changes. - Replaced PowerSchool’s entire board post-acquisition. - Directed the offshoring of IT and cybersecurity functions, including tools that bypassed consent protocols, enabling unauthorized access. - Failed to assess risks from the offshoring it mandated. - Oversaw layoffs of critical IT staff, including at least 5% of the workforce. The court dismissed Bain’s argument that a "disclaimer of control" clause in the acquisition agreement shielded it from liability, ruling that the firm’s actions demonstrated de facto control over PowerSchool’s operations. ### Broader Implications for Private Equity The ruling suggests that PE firms may face legal exposure for cybersecurity failures at portfolio companies, even if breaches occurred before acquisition. The case underscores the need for thorough pre- and post-acquisition cybersecurity due diligence, particularly when restructuring operations or reducing costs. While the litigation remains ongoing, the decision signals a potential shift in how courts view parent company liability in data breach cases especially when PE firms exert operational control over acquired entities.