Wall Street Firms Face Sophisticated Cyberattack Attempts

Major Wall Street financial services firms and money managers have faced a series of sophisticated attempted cyberattacks, including activity directed at large hedge funds and private equity firms.

The attempts targeted information systems at several institutions, according to sources cited by the source report. Public details remain limited because the incidents involve confidential security matters.

Cyber risk is also a financial crime risk

Attackers who compromise financial institutions may seek credentials, confidential deal information, payment access or data that can support fraud and extortion. Even an unsuccessful intrusion can expose weaknesses in authentication, third-party access or incident detection.

Firms should connect cybersecurity monitoring with fraud and AML controls. Indicators such as unusual administrator activity, changes to payment instructions and access from unexpected locations should be shared across security, operations and financial crime teams.

Incident plans should also cover rapid containment, regulatory notification and preservation of evidence. The attempted attacks reinforce the need to test resilience across investment managers and their service providers, not only traditional banks.

Areas attackers are likely to test

Investment firms hold valuable information about transactions, counterparties and wealthy clients, while relying on administrators, law firms, cloud platforms and other service providers. Attackers may therefore target email accounts and suppliers before attempting to reach a core trading or payment system.

Controls should include phishing-resistant authentication, separation of privileged accounts and independent verification of changes to bank details. Firms should also test whether vendors can detect and report incidents quickly. A tabletop exercise should cover compromised email, stolen data and fraudulent payment instructions occurring at the same time.

Questions for boards and risk committees

• Which critical services depend on a single external provider?
• Can the firm block compromised privileged accounts within minutes?
• Are payment changes verified outside email?
• When was the last joint cyber, fraud and financial-crime exercise?

Next focus: Firms should compare the attempted attacks for common infrastructure, techniques and suppliers. Even where no intrusion succeeded, shared indicators can reveal a coordinated campaign and help other institutions block the same approach before it reaches critical systems.