{"schema_version":"0.10.0","id":"LR-2026-0673","record_version":1,"title":"Cloned voices used in vishing attacks on Citadel, Point72 and Two Sigma","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.56,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Only a republished copy: Yahoo Finance · subject to change","original_document":null,"reports_total":2,"reports_independent":0,"reports_derivative":1,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Only a republished copy: Yahoo Finance · subject to change"}]},"sources_hash":"26240749363b30d3ba94c97be9c4f58390599f908a417e46899763f1f3bfacd8"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-05","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Attackers ran a coordinated wave of AI-powered voice-phishing attempts against Point72, Millennium, Two Sigma and Citadel in recent days. The calls used cloned or mimicked voices to pressure employees into surrendering credentials or granting system access. Point72 told investors it had been attacked, but its initial review found no client information was stolen, and it was still reviewing the incident. Two Sigma said its security team responded quickly and blocked the attempt, with no indication of impact to its data or systems. Citadel, Point72 and Millennium declined to comment, and FINRA has been in contact with member firms about the attempted breaches.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"Test applied: minor (contained to one deployer or evaluation, no third party touched). Fact: the sources report attempts with no stated impact on data or systems; Two Sigma says it has no indication of any impact to its data or systems, and Point72's initial review found no client information stolen.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.investmentnews.com/fintech/point72-citadel-among-hedge-funds-hit-by-ai-vishing-attacks/267708","publisher":"InvestmentNews","date":"2026-08-05","type":"press","title":"Point72, Citadel among hedge funds hit by AI vishing attacks - InvestmentNews","archived_url":null,"attachment":"first_report"},{"url":"https://ca.finance.yahoo.com/news/wall-street-hit-wave-ai-162208470.html","publisher":"Yahoo! Finance Canada","date":"2026-08-05","type":"press","title":"Wall Street hit by wave of AI-powered ’vishing’ cyberattacks - Bloomberg - Yahoo! Finance Canada","archived_url":null,"independence":"derivative"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":1,"quote":"The hackers attempted to breach information systems at major hedge funds—including Two Sigma Investments, Citadel, and Point72 Asset Management—as well as several private equity firms, according to people familiar with the matter who spoke to Bloomberg on the condition of anonymity."}],"event.adversarial_actor":[{"source_index":1,"quote":"The hackers attempted to breach information systems at major hedge funds—including Two Sigma Investments, Citadel, and Point72 Asset Management—as well as several private equity firms, according to people familiar with the matter who spoke to Bloomberg on the condition of anonymity."}],"impact.severity":[{"source_index":0,"quote":"Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems"}],"impact.severity_because":[{"source_index":0,"quote":"Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems"}],"event.summary":[{"source_index":0,"quote":"Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel were all targeted in a coordinated wave of cyberattacks in recent days, with attackers using AI-powered voice phishing to attempt to extract sensitive data from employees of the Wall Street money managers."},{"source_index":0,"quote":"Vishing attacks use technology to clone or mimic voices in phone calls, tricking employees into surrendering credentials or granting system access."},{"source_index":0,"quote":"According to a Bloomberg report on Wednesday, Point72 informed investors it had been attacked, though the firm's initial review found no client information was stolen."},{"source_index":0,"quote":"The firm told investors it was still reviewing the incident."},{"source_index":0,"quote":"Two Sigma, which manages $75 billion in assets, told Bloomberg it successfully blocked the attempt."},{"source_index":0,"quote":"Our security team responded quickly to an attempted vishing campaign targeting Two Sigma and other investment managers, and we have no indication of any impact to our data or our systems"},{"source_index":0,"quote":"Spokespeople for Millennium, Point72, and Citadel declined to comment to Bloomberg."},{"source_index":0,"quote":"FINRA has been in contact with member firms about the attempted breaches, according to a person with knowledge of the matter cited by Bloomberg."}]},"notes_on_gaps":"Sources do not name any AI model, developer, harness, tools, or deployment details; the AI is described only as a tool used by human attackers, so no autonomous agent involvement is recorded and agent-related fields are omitted. No exact date of occurrence is stated (only 'recent days'), and the disclosure date is not stated; the 2026-08-05 article date was not used as a disclosure date. Point72 said its initial review found no client information stolen but was still reviewing. Citadel and Millennium declined to comment, so their status is unknown. No controls are named as held, failed or missing, so the links list is empty. No remediation is reported. No trigger is stated, so event.trigger is omitted. Country is not stated for this incident, so it is omitted. Severity 'minor' is my judgement from the statements of no stated impact on data or systems. The Google blog, water-system attacks, and other firms' breaches in the source are other incidents and were excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Only a republished copy: Yahoo Finance · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"reached","text":"Point72 told investors it had been attacked, but its initial review found no client information was stolen.","quote":"According to a Bloomberg report on Wednesday, Point72 informed investors it had been attacked, though the firm's initial review found no client information was stolen.","source_index":0,"grade":"C"},{"step":"caught","text":"Two Sigma said it successfully blocked the attempt.","quote":"Two Sigma, which manages $75 billion in assets, told Bloomberg it successfully blocked the attempt.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.investmentnews.com/fintech/point72-citadel-among-hedge-funds-hit-by-ai-vishing-attacks/267708","https://ca.finance.yahoo.com/news/wall-street-hit-wave-ai-162208470.html"]},"analysis":{"sections":{"timeline":[{"text":"Point72 informed investors it had been attacked; its initial review found no client information was stolen.","quote":"According to a Bloomberg report on Wednesday, Point72 informed investors it had been attacked, though the firm's initial review found no client information was stolen.","source_index":0,"when":"Wednesday"},{"text":"Point72 told investors it was still reviewing the incident.","quote":"The firm told investors it was still reviewing the incident.","source_index":0,"when":null},{"text":"Two Sigma said it successfully blocked the attempt.","quote":"Two Sigma, which manages $75 billion in assets, told Bloomberg it successfully blocked the attempt.","source_index":0,"when":null},{"text":"FINRA has been in contact with member firms about the attempted breaches.","quote":"FINRA has been in contact with member firms about the attempted breaches, according to a person with knowledge of the matter cited by Bloomberg.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.investmentnews.com/fintech/point72-citadel-among-hedge-funds-hit-by-ai-vishing-attacks/267708","https://ca.finance.yahoo.com/news/wall-street-hit-wave-ai-162208470.html"]}}