Private funds hold what cybercriminals want: access to large pools of capital, confidential investment strategies, and detailed personal and financial information about their investors. A single intrusion at a manager or one of its service providers can lead to stolen funds, ransomware demands, regulatory scrutiny, and lost investor trust. What do federal, state, and international law require of fund managers, and how do regulators decide whether a manager did enough?
In this TalksOnLaw interview, Joel Cohen sits down with Ira Kustin, a partner in the investment management practice at Akin in New York who advises sponsors of and investors in hedge, credit, and private equity funds, and Sherrese Smith, Global Managing Partner of Paul Hastings and a longtime data privacy and cybersecurity lawyer, who were colleagues at Paul Hastings when they recorded this conversation. They explain the risks unique to private funds, the patchwork of privacy and cybersecurity rules that apply to U.S. investment advisers, and the policies and procedures regulators expect.
Why Private Funds Are Targets
Kustin says cyber risk to funds has moved from theoretical to real. Beyond stealing strategies and portfolio information, attackers can cause actual losses. Advisers typically do not hold custody of fund assets, but an attack on a prime broker or other service provider can still drain a fund. Smith adds that cybercriminals have become smarter and more targeted, and that funds are high-value targets. Attackers may not want to steal data at all. They may disrupt the business, destroy or hide data, or hold it for ransom. Legal liability follows, and reputational harm, though hard to quantify, can be the hardest to repair once investors lose trust.
Indemnification and the Standard of Care
Kustin points to a contractual consequence that managers often overlook. Fund documents typically indemnify the manager unless it has engaged in gross negligence, fraud, or intentional misconduct. A manager that follows best practices, updates its policies, and uses current security software will usually keep that protection. But a manager running software that is two years out of date and not paying attention may be acting recklessly enough to be found grossly negligent, and could lose its indemnification.
The Investor Data Problem
Subscription documents contain investors' Social Security numbers and information about their income and assets. That information also sits with the fund's administrator, auditor, and other service providers, and Kustin notes that the SEC now expects advisers to exercise some oversight over those third parties. Smith explains why even modest data is valuable. Criminals build large databases just as legitimate companies do, combining information from many sources and selling it on the dark web. A file that began with one fund's investor records can unlock someone's bank accounts and other assets.
A Patchwork of Privacy Laws
The Advisers Act had no rule specifically addressing cybersecurity, Kustin says, but the SEC has signaled its expectations through risk alerts and annual examination priorities. Regulation S-P and Regulation S-ID may apply to private fund managers in certain circumstances. Smith explains that the Gramm-Leach-Bliley Act reaches SEC-registered advisers that collect personal information, though a manager with only institutional investors may fall outside it, and that Regulation S-P requires privacy notices. Many managers are tripped up by state law. California's consumer privacy law generally does not regulate data covered by Gramm-Leach-Bliley, but funds often collect other data that it does reach, and Smith describes Virginia's law in similar terms. The European Union's General Data Protection Regulation, in her view, applies to managers that collect information from European residents, with demanding notice, breach notification, and security requirements.
One Privacy Policy, Many Jurisdictions
Once a manager knows which laws apply, Kustin says, the privacy policy itself is one of the more straightforward obligations. It is typically attached as an annex to the subscription documents so every investor receives it. Smith stresses that managers do not need separate policies for each investor or fund. One omnibus policy can cover every relevant jurisdiction, though managers must track differing annual delivery requirements. Offshore structures add more layers. A typical master-feeder hedge fund may use a Cayman, BVI, or Bermuda vehicle, and Cayman has a relatively new and robust data protection regime. Smith warns that foreign laws can reach managers with no operations there.
How the SEC Regulates Without a Cyber Rule
The SEC relies on the Advisers Act compliance rule, which requires policies and procedures reasonably designed to prevent violations, and on staff guidance. Smith frames the standard as reasonableness under the circumstances. Regulators expect advisers to safeguard accounts and verify investors' identities, oversee vendors, respond to malicious emails, and maintain a ransomware playbook covering response, reporting, and whether to pay. After Colonial Pipeline, she says, no firm can claim it did not know ransomware was a threat. Kustin cites a November 2020 risk alert emphasizing the annual review of compliance policies. Procedures designed for the threats of 2017 may not satisfy examiners today. Risk alerts are not rulemaking and carry disclaimers to that effect, he explains, but advisers ignore them at their peril, and the general wording of the rules gives the SEC considerable room to enforce.
Vendors, Remote Work, Enforcement, and Notification
"Your third parties are always going to be the problem," Smith tells clients. Many breaches begin with a vendor that lacked promised controls or cut corners by hiring another vendor, so contracts should anticipate incidents and provide indemnification. Kustin adds that remote work has multiplied the risk, because firms cannot build a fortress around staff working from home. On enforcement, his instinct is that the SEC is unlikely to act against an adviser that took reasonable steps and was nonetheless attacked, but it may be more forceful with advisers that are reckless or whose procedures are missing or outdated. If a breach occurs, notice to regulators and investors will likely be required, with content and timing depending on where the manager, the fund entities, and the investors are located.
What to Know Now
The largest change is that SEC-registered advisers now face specific federal cyber requirements. In May 2024 the SEC amended Regulation S-P to require incident response programs, notice to affected individuals generally within 30 days of unauthorized access to sensitive customer information, and oversight of service providers, including 72-hour breach notice to the adviser. Compliance began December 3, 2025 for larger advisers and June 3, 2026 for smaller ones, and the rules reach private fund advisers' information about individual investors. The amendments also codified an exception to the annual privacy notice for firms that share information only within statutory exceptions and have not changed their practices. The SEC withdrew its broader 2022 cyber proposal for advisers and funds in June 2025. The Division of Examinations' 2026 priorities target Regulation S-P compliance, identity theft programs that detect account takeovers and fraudulent transfers, ransomware, AI-driven threats, and the accuracy of firms' claims about AI, and a September 2026 risk alert faulted many advisers' annual compliance reviews. Large hedge fund advisers must also file Form PF current reports within 72 hours of certain events, including significant disruptions of key operations. An April 2026 proposal would narrow those events and eliminate private equity event reports, which supporters call burden relief and critics say would reduce regulators' view of market stress.
Enforcement has continued for basic failures. In November 2025 the SEC fined a broker-dealer and adviser $325,000 over email account takeovers, missing multifactor authentication, and a stale identity theft program. At the same time, the Commission has refocused on fraud and, after a court dismissed most of its case against SolarWinds, dropped the remaining claims. Some welcome less second-guessing of breach victims, while others worry about weaker deterrence. About twenty states now have comprehensive privacy laws. Several, including Virginia's, exempt financial institutions subject to Gramm-Leach-Bliley entirely, while Connecticut and Montana have moved to narrower, largely data-level exemptions. California will require cybersecurity audits beginning in 2028. The GDPR reaches non-EU managers that offer services to or monitor people in the EU, not every firm that receives European residents' data. AI has also sharpened the threat. A Hong Kong employee of Arup wired about $25 million after a video call with deepfaked executives, FinCEN has warned financial institutions about deepfake fraud, and the FBI received complaints reporting more than $3 billion in business email compromise losses in 2025 alone.
