Blackstone, CME Among 9 Firms Hit by Phone-Based Hacks; Some Paid Ransoms

For market participants, the revelation that hackers specifically targeted Blackstone, CME, and other heavyweights is a reminder that cyber risk directly translates into financial risk. With some firms reportedly paying ransoms, investors must now consider the potential for undisclosed breaches or future regulatory fines. The campaign's focus on deal-rich private equity firms suggests a high-stakes effort to obtain market-moving intelligence, placing a premium on cyber due diligence.

An active cyber-espionage and extortion campaign has been targeting prominent U.S. private equity firms and financial institutions, leveraging low-tech phone-based social engineering to bypass sophisticated security perimeters. Data reviewed by Reuters and a Google blog post published on August 6, 2026, reveal that threat actors—operating under the aliases Redact, Pink, Falcon, and Helix—constructed phishing websites aimed at harvesting credentials from employees of at least nine major firms, including Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital, and Moody’s. The hackers used voice phishing (vishing) calls to persuade targets to visit these fake login portals, a technique that exploits human psychology rather than technical vulnerabilities.

“

Blackstone (BX) and CME Group (CME) shares showed mixed reactions in early trading following the report, with BX dipping 0.8% and CME edging up 0.3%.

The campaign unfolded over the past month, with Google’s Threat Analysis Group noting that the groups recently shifted focus to private equity, law firms, and financial services, sectors where a successful breach could yield sensitive deal-flow data, market-moving intelligence, and personal client information. Some victim organizations paid ransoms, according to Google, though the specific companies and amounts remain undisclosed. Reuters’ own investigation, however, could not independently confirm which entities were successfully compromised. The hackers’ reliance on phone calls underscores a persistent challenge: while organizations invest heavily in AI-driven threat detection, endpoint security, and zero-trust architectures, the human element consistently remains the weakest link. As Lee Clark of the Retail and Hospitality ISAC observed, “Because the fence is now so fancy and high-tech, we just have to trick the guard into opening the door for us.”

The targeting of private equity titans carries profound implications. Blackstone, KKR, and Apollo collectively manage trillions in assets and hold privileged information about portfolio companies, M&A activity, and investor commitments. A breach at any of these firms could lead to the exfiltration of material non-public information, potentially triggering market manipulation, insider trading, or reputational crises. Moreover, ransom payments to the groups may incentivize further attacks, creating a pernicious cycle that endangers the broader financial ecosystem. Regulatory bodies, including the SEC and FTC, will likely scrutinize the incident, particularly given new cybersecurity disclosure rules that require publicly listed companies to report material breaches. The fact that some firms paid ransoms may also attract attention from the U.S. Treasury’s Office of Foreign Assets Control (OFAC), which has warned that ransom payments could violate sanctions if the recipients are sanctioned entities.

From a market perspective, the news coincides with growing investor anxiety around cybersecurity risks in the financial sector. Blackstone (BX) and CME Group (CME) shares showed mixed reactions in early trading following the report, with BX dipping 0.8% and CME edging up 0.3%. While the immediate financial impact appears limited, prolonged uncertainty or disclosure of a material breach could weigh on valuations, especially for firms that rely heavily on trust and confidentiality.