A phone-first data-theft extortion campaign has targeted dozens of major US financial firms over the past month. The targets included private equity firms and financial companies such as Blackstone, Bridgewater Associates, Apollo Global Management, Bain Capital, KKR, TPG, CME Group, Clearlake Capital and Moody’s. More than 200 companies targetedAdvertisementThe campaign was much broader than Wall Street. Companies can deploy strong authentication, endpoint protection and other technical controls, but attackers may simply target the person operating them. For financial firms, the risk extends beyond stolen credentials.