Other People’s Networks: What October’s Cyber Incidents Mean for Private Equity 

Private Equity is a distributed business by design. A mid-sized GP might rely on a fund administrator, a virtual data room, two or three law firms, an outsourced IT provider and a handful of SaaS platforms before it counts a single portfolio company. Each portfolio company brings its own chain of suppliers, and buy-and-build strategies stitch those chains together. That makes Private Equity cyber risk a question of connections as much as of individual companies. 

Most cyber oversight in the industry still works company by company. October was a useful reminder of what that approach misses. Very little of what went wrong this month started inside the victim’s own network.

One cloud facility, several banks

On Tuesday 20 October, a power failure at a third-party facility in Google Cloud’s London region (europe-west2) disrupted services for several hours. Revolut, Lloyds and HSBC were among the banks affected. At Revolut, customers lost access to logins, card payments and cash withdrawals.

The regulatory response was quick. The European Banking Authority contacted Google, the FCA said it was engaging with the company, and the Treasury Committee wrote to the Bank of England and the FCA asking about the scale of the disruption. Reuters described the outage as the first major test of the new regimes for critical third parties: the EU designated 19 technology firms last year, and the UK has designated four cloud providers. The EBA was explicit that designation does not move responsibility away from the financial firms that depend on those providers.

Two details matter for private equity. First, the failure sat in a third-party facility used by Google, one layer beyond the provider most customers would list on a vendor register. Dependency chains run deeper than the contracts suggest.

Second, the outage hit several firms at once. That is the scenario most portfolio resilience plans are not built for. Each company’s plan assumes it is the one in trouble and that its suppliers are on hand to help. When several companies share a cloud region, a managed service provider or a payroll platform, one failure lands across the portfolio at the same time, along with the questions from lenders and LPs. Buy-and-build can sharpen the problem, because moving add-ons onto a shared platform is often part of the synergy case.

The same concentration starts at the manager level. In Thomas Murray’s Out of Sight index of 558 PE firms, published in July, the infrastructure behind the firms’ external footprint spans 52 countries, against 25 countries where the firms are headquartered. Few firms could say with confidence where all of it physically runs. 

The deal perimeter includes your advisers

The second thread ran through professional services. On 28 October, Coveware, the ransomware response firm owned by Veeam, published an open letter to senior partners at law firms. It followed a leak of internal chats from the Silent Ransom Group, an extortion crew the FBI warned in May was impersonating IT staff to get into US law firms, at times by turning up in person. Coveware says the leak identified several victims that had paid to keep their incidents out of public view, and it expects most of the Am Law 100 to have been affected by the time the campaign winds down.

Separately, PwC confirmed an incident on 23 October involving a third-party vendor that hosted employee learning records, after an extortion group claimed to have taken a large volume of data. PwC said the affected site held no client data and that its own network and operations were not affected. Warp and ENGIE both disclosed breaches during the month that came through vendor or partner platforms rather than their own systems.

For deal teams, the implication is direct. During a live transaction, the most sensitive information about a target, a valuation or a financing structure often sits with counsel, accountants and data-room providers rather than with the fund. These firms are being targeted precisely because of what they hold. Asking advisers how they verify inbound IT support calls, and how quickly they would tell you about an incident, is a reasonable part of any pre-engagement checks. 

One laptop, one set of keys

The month’s largest loss was at Binance. In a preliminary update after the theft on 29 October, the exchange said a compromised laptop belonging to a DevOps engineer gave the attacker access to a service that submitted unauthorised withdrawals, though it later said the attack involved additional points of breach. Binance put the impact at about $6.3bn, with around $3bn frozen, said it had found no evidence that wallet private keys were leaked, and has said it will absorb the losses itself. On 31 October the FBI attributed the theft to TraderTraitor, a North Korean state-sponsored group also tracked as Lazarus. A full technical report is still to come, and the figures may change.

Few portfolios include a crypto exchange, but the pattern is familiar. One person’s device, with broad privileged access to a payment function, was enough. In Private Equity the equivalent sits in fund treasury and capital call processes, in portfolio company finance teams, and with the administrators who can move money. It also echoes the summer, when Apollo confirmed a breach that followed a social engineering campaign Google researchers said was aimed at Private Equity and financial firms. Coveware’s third-quarter figures point the same way: phishing and social engineering were the leading route in, at around 29% of cases, with compromised credentials rising.