The most consequential cyberattacks hitting the financial sector this summer did not start with malware or a zero-day exploit. They started with a phone call.
On August 21, Apollo Global Management disclosed in a letter filed with the California Attorney General that attackers used social engineering to gain access to its cloud environment between July 6 and July 10, taking names, dates of birth, contact information, and Social Security numbers. Apollo was not alone. Reuters has reported that dozens of prominent U.S. financial institutions—including Blackstone, KKR, Bain Capital, Bridgewater, TPG, CME Group, and Moody’s—were targeted by the same ransom-seeking campaign. Google’s Threat Intelligence Group, which tracks the actors as UNC6671 and links them to the Redact, Pink, Helix, and Falcon extortion brands, describes the playbook: attackers call employees on their personal mobile phones, pose as IT helpdesk staff pushing an urgent security migration, and steer them to spoofed login portals where adversary-in-the-middle infrastructure captures both credentials and MFA tokens. Demands reportedly run from $750,000 to $3 million per victim.
Low-Tech Attack, Full-Sized Consequences
It is tempting to treat vishing as a lesser threat because it requires no technical sophistication. Regulators will not see it that way, and neither should legal and compliance teams. Once an attacker uses a stolen credential to access systems containing customer information, the legal posture is identical to any other intrusion:
- State breach notification statutes are triggered by unauthorized acquisition of personal information, regardless of how the attacker got in.
- The SEC’s amended Regulation S-P requires covered institutions to notify affected individuals as soon as practicable, but no later than 30 days after becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. The amendments are now fully in effect for large and small institutions alike.
- NYDFS Part 500.17(a) requires covered entities to notify the Superintendent within 72 hours of determining that a reportable cybersecurity incident has occurred. A credential-based cloud compromise will also draw scrutiny of the controls Part 500 mandates—including universal multi-factor authentication, which became fully effective November 1, 2025, and regular security awareness training.
In other words, the entry point may be low-tech, but the notification analysis, regulatory exposure, and litigation risk are not.
What Financial Institutions Should Do Now
This campaign exploits people and process, so the response has to reach beyond the security stack:
- Retrain for the phone. Most security awareness programs are built around suspicious emails. Employees need scripts and escalation paths for unexpected calls—especially calls to personal devices purporting to come from internal IT.
- Harden the help desk. These actors also spoof legitimate helpdesk numbers and use compromised email accounts to reset passwords for non-SSO applications while deleting the confirmation messages. Verification protocols for credential and MFA resets should be as rigorous as those for wire transfers.
- Upgrade MFA. Because these attacks intercept one-time codes in real time, push- and SMS-based authentication offer little protection. Google, the FBI, and CISA all recommend phishing-resistant MFA that cryptographically binds credentials to legitimate domains.
- Pressure-test the incident response plan. If your plan assumes the intrusion begins with an email or an endpoint alert, walk through a scenario that begins with a phone call and ends in your cloud environment. Confirm that identity and cloud logging is sufficient to reconstruct what was accessed—because your notification obligations will turn on exactly that question.
The attackers behind this campaign have proven that a phone call can open doors that firewalls cannot protect. Financial institutions should assume they are on the call list.