Last week brought a stark reminder that even the most sophisticated financial institutions are only as secure as their weakest access point: a human on the phone. According to Bloomberg, reported by Reuters, hackers launched a coordinated wave of attacks against some of the largest hedge funds and private equity firms in the world, including Point72 Asset Management, Two Sigma Investments, and Citadel.
Point72 confirmed it was attacked, though early indications suggest no client data was taken. Two Sigma, which manages roughly $75 billion in assets, said it successfully blocked attempts to access sensitive systems. The attack vector wasn’t malware or a zero-day exploit. It was vishing: voice phishing calls designed to impersonate trusted contacts and manipulate employees into handing over credentials or granting direct access.
Why This Story Matters Beyond Wall Street
It’s tempting to read this as a hedge fund story. It isn’t. It’s an access control story, and it applies to every financial services organization handling sensitive data, from asset managers to regional banks to insurance carriers.
Vishing works because it targets the layer that most security stacks still treat as an afterthought: the moment a human grants access. Email security tools, endpoint detection, and network monitoring are all built to catch malicious code or suspicious traffic. None of them are designed to stop an employee who believes they’re on the phone with IT support or a senior executive and willingly hands over the keys.
We’ve written before about how vishing exploits the trust built into voice communication to bypass the technical defenses organizations spend the most money on. This attack wave is proof that the tactic is not going away. If anything, attackers are getting more targeted, more convincing, and more willing to go after the biggest, best-resourced firms in finance.
Social Engineering Doesn’t Care How Good Your Perimeter Is
Traditional network security assumes that once someone is authenticated, they can be trusted for the rest of the session. Vishing attacks exploit exactly that assumption. An attacker doesn’t need to break through a firewall if they can convince a real employee to open the door for them.
This is where zero trust network access control changes the equation. Zero trust doesn’t assume that a successful login means a user should keep unrestricted access. Every access attempt is continuously verified against identity, device posture, and contextual risk, whether that access request comes from an employee, a contractor, or a service account. If an attacker does manage to social-engineer their way past a human, a zero trust architecture limits how far that access actually gets them.
Specific controls that directly blunt the impact of a successful vishing call include:
- Passwordless, phishing-resistant authentication. If there’s no password to divulge over the phone, the entire premise of the attack collapses. See our breakdown of zero trust access control for how this works in practice.
- Least-privilege segmentation. Even a compromised identity should only reach the specific resources it needs, not the entire network.
- Continuous device and risk verification. Access decisions shouldn’t be one-time events at login. They should be reassessed in real time based on device health and behavioral signals.
- Rapid revocation. If a compromised credential is identified mid-session, access should be revocable instantly, not at the next login cycle.
The Compliance Angle Financial Services Firms Can’t Ignore
For regulated financial institutions, this isn’t just a security best practice question. It’s a compliance one. The Gramm-Leach-Bliley Act requires covered organizations to maintain an information security program that controls access to systems storing customer financial data. A vishing incident that results in unauthorized access, even without confirmed data loss, is exactly the kind of event regulators and auditors will scrutinize closely.
The Takeaway
Attempts to break into major financial institutions are, as cybersecurity experts quoted in the coverage noted, fairly routine. What made last week’s news notable is the scale and coordination of the targets, not the method. Vishing has been a known threat for years. The firms that come out ahead aren’t the ones hoping employees never fall for a convincing call. They’re the ones that have already assumed someone eventually will, and built access control that limits the damage when it happens.
If your organization’s access strategy still depends entirely on getting the human layer right every single time, it’s worth a hard look at where zero trust could close that gap before the next call comes in.
