INDUSTRY FACT FILE · CONGLOMERATES, HOLDING COMPANIES & INVESTMENT GROUPS

Threat Landscape: Top Cyber Threats Facing Groups and Investment Firms

The 18 most relevant cyber threats, attacks and industry challenges for business groups, holding companies, CICs, family offices, PE and VC firms, portfolio companies and shared-services centres, and the impact each has.

Groups and investment firms face attackers with different aims. Ransomware groups target operating companies, shared-services centres and IT outsourcers because one foothold can encrypt systems used by many entities, and the pressure on a group to restore operations is high. Fraudsters target treasury desks, family offices and finance teams in group companies, impersonating chairmen, CFOs, promoters, advisers and suppliers by email, phone and now cloned video. Information thieves target deal teams, data rooms and advisers, because price-sensitive information about acquisitions and results is valuable. Opportunistic attackers find the weakest company in a portfolio, often a recent acquisition or a small investee, and move from there. And many problems are self-inflicted: integrations rushed to meet a Day-1 deadline, privileged accounts shared with outsourcers, and Boards that see only the controls of the parent.

Public reporting shows how these risks have played out. NotPetya in June 2017 spread through connected group networks, costing Maersk an estimated US$250–300 million and leading Mondelez to claim more than US$100 million of losses. Marriott acquired Starwood in 2016 with attackers already inside Starwood's reservation systems; about 339 million guest records were affected and the UK regulator later fined Marriott £18.4 million. Verizon cut its Yahoo price by US$350 million in 2017 after breach disclosures. In 2024 Arup confirmed a loss of about US$25 million after a deepfake video call. In September 2025 an attack halted Jaguar Land Rover's UK production for weeks, and the UK Cyber Monitoring Centre estimated the UK impact at about £1.9 billion across more than 5,000 organisations. Indian groups share the same structures, platforms and deal processes, so the same patterns apply.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by group and investment segment (Codec Networks assessment).

4.1 Shared identity and the path from one company to all

Consolidated directories, single sign-on and shared email tenants make groups efficient but turn one privileged account into a key for every company. Directory trusts created during integrations, outsourcer accounts with standing admin rights and service accounts reused across entities let attackers move from a weak subsidiary to group domain controllers and ERP. NotPetya showed in 2017 how fast connected group networks fail together.

• Questions to test: Who holds administrative rights across more than one entity? Are admin tiers separated and protected with MFA and privileged access management? Which directory trusts exist and are they still needed? Could we isolate one company within hours? Would the SOC notice a subsidiary account using group admin tools?
• Relevant services: directory, trust and privileged access reviews, tiered administration design, segmentation and isolation planning, red team exercises from a subsidiary foothold and shared SOC use cases for cross-entity movement.

4.2 Inherited breaches and cyber due diligence

When a company is bought, its intruders, weaknesses and liabilities come with it. Marriott's acquisition of Starwood in 2016 brought a breach that dated from 2014 and was found only in 2018, and Verizon cut its price for Yahoo by US$350 million after breach disclosures. Financial and legal diligence rarely look for active compromise, and integrations often connect the target before anyone has.

• Questions to test: Do we run technical cyber diligence before signing on every material deal? Do we check for existing compromise before closing? Are cyber warranties, specific indemnities and conditions in the documents? Is the target kept separate until a security gate is passed? Is it monitored from Day 1?
• Relevant services: cyber due diligence, external exposure and leaked credential reviews, compromise assessments, inputs to warranties and indemnities, integration security gates and Day-1 and 100-day monitoring plans.

4.3 Deepfake impersonation and treasury fraud

Treasury desks, family offices and finance teams act on instructions from chairmen, CFOs and promoters, often urgently and confidentially. Cloned voices and faces now make those instructions convincing; in 2024 Arup confirmed that an employee transferred about US$25 million after a video call with deepfaked colleagues. Controls that rely on recognising a voice or face no longer work.

• Questions to test: Is every new payee and every urgent transfer confirmed by a call-back to a known number? Do transfers above a threshold need two independent approvers? Do staff have code words or procedures for confidential deals? Have we simulated a deepfake request? Would unusual payees or timing raise an alert?
• Relevant services: treasury and payment approval control testing, deepfake and business email compromise simulations, awareness for principals and staff, banking portal reviews and monitoring of payment anomalies.

4.4 Portfolio company weaknesses and value at exit

Funds and groups own companies at very different levels of maturity. A ransomware attack on an investee can halt operations, and a buyer's diligence can find unpatched remote access, missing backups or past incidents that reduce the price or delay the deal. LPs, lenders and insurers increasingly ask how the owner measures and improves portfolio cyber risk.

• Questions to test: Do we set a cyber baseline at entry for every investee? Do we score and compare portfolio companies each year? Are backups and recovery tested? Do investees have monitoring and an incident retainer? Could we produce an exit-ready evidence pack?
• Relevant services: portfolio baselines and benchmarking, investee VAPT and cloud reviews, backup and recovery testing, portfolio SOC, incident response retainers and exit readiness reviews.

4.5 Board visibility, disclosure and group reporting

Boards and risk management committees answer for cyber risk under the Companies Act and SEBI's LODR, and listed entities must disclose cyber incidents in quarterly governance reports. Yet many receive reports on the parent alone, or narrative assurances without comparable metrics. Incidents in a subsidiary, a shared-services centre or an outsourcer can then surprise the Board, delay CERT-In reporting and complicate disclosure.

• Questions to test: Does the Board see comparable metrics for every material entity? Are incidents in subsidiaries and suppliers escalated to the group within hours? Who decides on CERT-In reporting and stock exchange disclosure? Have directors rehearsed a group-wide incident? Are insurance limits matched to group scenarios?
• Relevant services: group maturity scoring, Board and risk committee dashboards, incident escalation and disclosure playbooks, crisis tabletop exercises and cyber insurance limit and aggregation reviews.

• CERT-In: incidents reported within six hours of noticing them by each body corporate concerned; logs kept for 180 days in India and available for investigation.
• SEBI and stock exchanges: cyber incidents in listed entities disclosed in quarterly governance reports and, where material, under event disclosure rules; risk committee oversight examined; UPSI leaks may lead to inquiries under the PIT Regulations.
• SEBI CSCRF: incidents at AIF and portfolio managers handled under the framework's reporting and response requirements for their category.
• RBI and sector regulators: incidents in regulated group companies reported under their own directions; CIC risk governance examined.
• DPDP Act: breach intimation and safeguards for personal data once provisions commence, entity by entity; data shared across the group traced to each data fiduciary.
• Buyers, lenders, LPs and insurers: warranty and indemnity claims, covenant questions, LP enquiries and insurance notifications follow incidents in group and portfolio companies.

• If ransomware struck one subsidiary tonight, could it reach the rest of the group?
• Who holds administrative rights across more than one company, and are they protected?
• Do we check every target for existing compromise before closing?
• Could a convincing call from our chairman or CFO move money today?
• Does the Board see comparable cyber metrics for every material entity and investee?
• Could we detect, contain and report an incident within six hours in any group company?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific group, fund or company. Public incident references are summarised from official statements, regulator decisions and widely reported events, and no inference is drawn about the governance of any named organisation or its owners. Attack techniques are described only at the level needed to explain defences.