Cybercriminals Target Major U.S. Financial Firms in Vishing Extortion Campaign Google’s security researchers revealed on Thursday that unidentified hacking groups are actively breaching large U.S. financial and investment firms to steal sensitive data and extort victims by threatening to leak it. Among the targeted organizations are prominent private equity firms, including Apollo Global Management, Bain Capital, Blackstone, Bridgewater Associates, CME Group, KKR, Moody’s, and TPG. The attackers tracked by Google under the names Falcon, Helix, Pink, and Redact employ voice phishing (vishing), a social engineering tactic where hackers impersonate coworkers or IT support over phone calls to trick employees into divulging credentials and multi-factor authentication codes on spoofed websites. Some groups operate dedicated leak sites to pressure victims into paying ransoms, with one site stating that data publication is a "consequence of refusal to engage." Google’s report suggests these groups may operate under a larger collective, UNC6671, though their exact relationships whether affiliates, splinter factions, or users of a shared Phishing-as-a-Service infrastructure remain unclear. The researchers speculate the groups may compartmentalize operations to obscure breach volumes and isolate negotiation risks. Beyond financial firms, the hackers have previously targeted manufacturing, real estate, healthcare, insurance, tech, transportation, and hospitality sectors, seeking intellectual property, source code, and VIP client data. Their recent focus on legal and financial organizations particularly those involved in mergers, acquisitions, and litigation appears strategic, aiming to exploit high-value corporate data for maximum extortion leverage. Financially, the groups have seen success: one cryptocurrency wallet linked to the operation received $10 million in Bitcoin in early 2024, with ransom demands typically ranging from $750,000 to $3 million per victim. Representatives for CME Group declined to comment, while the other named firms did not respond to inquiries.

Bridgewater Reports Data Breach Impacting Sensitive Personal and Health Information Bridgewater recently disclosed a data breach to the California Attorney General’s office, revealing that unauthorized access to its systems may have compromised sensitive personal identifiable information (PII) and protected health information (PHI). The incident was detected on or around December 24, 2025, after suspicious activity was identified within the company’s computer networks. Following an internal investigation, Bridgewater confirmed that an unauthorized third party accessed or acquired data stored in its systems. The exposed information varies by individual but may include: - Full names - Social Security numbers - Contact details - Medical records or health-related information tied to legal representation - Case-related documents On December 31, 2025, Bridgewater began notifying affected individuals via mail, detailing the specific types of compromised data. As part of its response, the company is offering 12 months of complimentary credit monitoring services to impacted parties. The breach notice filed with California authorities provides further details on the incident.