{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-vc-firm-insight-partners-breached-through-social-engineering-attack"},"incident":{"slug":"2025-vc-firm-insight-partners-breached-through-social-engineering-attack","title":"VC firm Insight Partners breached through social engineering attack","date":"2025-01","date_precision":"month","year":2025,"victim_org":"Insight Partners","sector":"Financial Services","country":"United States","primary_vector":"Spear Phishing (Email)","secondary_vectors":[],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Data Breach","Extortion"],"loss_usd":null,"loss_kind":null,"loss_note":"","records_affected":null,"threat_actor":null,"summary":"New York venture capital firm Insight Partners, which manages tens of billions of dollars, confirmed that it suffered a cyber incident in January 2025 that began with a social engineering attack. The firm later notified employees, limited partners and portfolio-company contacts that personal, banking and tax information, fund data and transaction details had been taken. Investigators found the intruders had been inside the environment for a period before discovery.","how_it_worked":"Insight Partners stated publicly that the intrusion was the result of a social engineering attack rather than an exploited vulnerability. Investment firms are a high-value pretext environment: staff routinely exchange documents and wire instructions with founders, co-investors, lawyers and limited partners they have never met in person, so an approach from an unfamiliar sender referencing a live deal reads as normal. The attackers used that trust to obtain access to internal systems, then spent time collecting fund-level financial data, banking and tax details for individuals, and transaction records, before the activity was detected and remediated.","lessons":"For deal-driven firms, phishing-resistant MFA plus verified out-of-band confirmation for any document or credential request from outside the firm is the control that matters.","confidence":"Confirmed","sources":[{"title":"Statement from Insight Partners on Cyber Incident","url":"https://www.insightpartners.com/ideas/statement-from-insight-partners-on-cyber-incident/","publisher":"Insight Partners"},{"title":"VC giant Insight Partners notifies staff and limited partners after data breach","url":"https://techcrunch.com/2025/09/17/vc-giant-insight-partners-notifies-staff-and-limited-partners-after-data-breach/","publisher":"TechCrunch"}],"entry_type":"incident","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-vc-firm-insight-partners-breached-through-social-engineering-attack"}}