Insight Partners suffered a data breach in January stemming from what it described as “a sophisticated social engineering attack.”
In a statement published Tuesday, the private equity and venture capital firm said it initially detected unauthorized access to "certain Insight information systems" on Jan. 16. Insight Partners did not specify what types of systems or data were affected by the cyberattack.
"As soon as this incident was detected, we moved quickly to contain, remediate, and start an investigation within a matter of hours," the statement said. "We notified stakeholders connected to Insight in January to alert them and encourage vigilance and tightened security protocols irrespective of having shared data compromised. We also notified law enforcement in relevant jurisdictions."
The breach was first reported by Calcalist before Insight Partners’ public disclosure. Insight Partners said there were no additional disruptions to the company's operations and no evidence that the threat actor was present in the corporate network after Jan. 16.
"We are working diligently to determine the scope of the incident with the support of third-party cybersecurity experts, a leading forensic and eDiscovery expert, and external legal counsel which, as shared with stakeholders, will take several weeks," the statement said. "We don't believe, based on what is known, there will be any material impact on portfolio companies, Insight funds or other stakeholders. Insight will update any impacted individuals once information becomes available during our investigation."
The New York-based firm holds investments in several major technology companies, including cloud security startup Wiz, IT management software maker Kaseya and IoT security vendor Armis. Since its founding in 1995, Insight Partners has invested in more than 800 companies across the globe, primarily in the IT and software sectors.
Social Engineering Attack, Few Details
Just how the cyberattack hit the company is unclear. Cybersecurity Dive contacted Insight Partners for comment, but the company has not yet responded.
Insight Partners' breach follows a series of notable social engineering attacks in recent years from cybercriminal groups that include Scattered Spider and Lapsus$. Additionally, many threat actors have increasingly focused on compromising high-value targets, including major technology companies, to gain access to victim organizations' downstream clients for ransomware and/or data extortion attacks.
