Hackers target Blackstone and CME in broad financial sector campaign

Hackers used fake IT and help-desk calls, plus fraudulent websites, to target dozens of prominent U.S. financial institutions, including Blackstone and CME data systems, in a campaign that pushed deeper into the plumbing of finance than a single firm breach.

The operation aimed at employee passwords and authentication codes, the keys that often unlock internal networks, deal rooms and market data systems. Reuters-linked republished coverage said the attackers built 72 malicious websites to catch victims, a scale that suggests a coordinated effort to harvest credentials across private equity, market infrastructure and other parts of the financial sector.

Blackstone and CME matter because each sits at a different but equally sensitive point in the market ecosystem. Blackstone controls vast pools of private capital and transaction information; CME is tied to data and trading infrastructure that market participants rely on for pricing, execution and risk management. An intrusion into either environment could expose confidential deal documents, operational information or authentication paths that extend to clients, counterparties and vendors.

The campaign also reflects how financial cyberattacks have broadened beyond banks. Private equity firms, trading venues and data platforms now hold the kind of proprietary information that criminals can sell, extort or reuse in later attacks. Those firms are deeply connected to cloud services, outsourced support desks and third-party software, which means one successful credential theft can open doors well beyond the first target.

The attack pattern matched a broader surge in pressure on the sector. Major Wall Street hedge funds were targeted in attempted cyberattacks on Aug. 5, and Liechtenstein authorities said a separate hacker incident on Aug. 4 did not result in stolen financial data. Together, the cases show how often intruders are testing identity systems, not just perimeter defenses, in a sector where access itself can be as valuable as money.

The names tied to the campaign, including Blackstone, CME, Apollo, KKR and Moody's in related coverage, underline how widely the threat is spreading across the financial services ecosystem. The immediate risk is stolen credentials and disrupted operations; the longer-term risk is that market-sensitive data and internal access routes can be mapped, sold or used in later intrusions.