What Can Hackers Do With a VC’s Due Diligence Data?
A hacker who steals a venture firm's due diligence files gets a map of an entire sector. A diligence package describes the competitive landscape, the rival companies the firm evaluated, where the best science and the clinical trial data sit, and which companies have weak defenses. Chad Raduege, a retired U.S. Air Force brigadier general, calls due diligence the point where national security starts to apply, because a single breach at an investor can expose every company in the file at once.
Raduege commanded the White House Communications Agency and served as director of C4/Cyber and CIO for U.S. European Command. He made the argument on Open Door Salon after Lori Ellis raised a real incident: Insight Partners disclosed that an attack it detected in January 2025 reached information on its funds, its portfolio companies and its limited partners. The firm said it detected the intrusion on January 16, 2025, and traced it to a social engineering attack. Its later breach notifications said the attackers first got in during mid-October 2024, began encrypting systems on January 16, and affected more than 12,600 people.
Why is due diligence data more valuable than one company's network?
Because it compares companies. A company protecting its own network protects one set of assets. An investor's diligence work pulls together information about many companies competing for the same money, and it ranks them. Raduege put it this way:
Due diligence is really an insightful word or phrase. And that's where I start saying, this is where national security starts being applied.
He contrasted that with how a single company thinks about security. A company protecting its own resources tends to focus on its own small group, its own network and its own data. An investor running diligence is assembling information about companies that compete with one another, and it holds that information in one place.
The value to an adversary is the synthesis. Individually, much of the information might be scattered across dozens of networks with different defenses. The diligence file has already done the work of collecting and comparing it.
What is actually inside a diligence package?
More than the portfolio. Raduege described the scope of the work an investor does before committing capital:
They're looking at the competitive marketplace that's out there. They're evaluating other rival companies to figure out who they're going to invest dollars in.
That includes an honest read of each company's weaknesses, and cybersecurity maturity can be one of them:
Maybe it's a 40-person company that doesn't have a CISO or a CIO, and so they have not put the cybersecurity mechanisms in place.
A file like that tells an adversary which companies hold the most valuable science and which of them would be easiest to enter. The companies an investor evaluated and declined are in it too, a point Lori Ellis raised and Raduege agreed with.
Why does a retired general see this as a national security issue?
Because of what the file adds up to. Raduege's reaction when he thinks about investors' holdings was blunt:
When I look at the venture capitalists, I say, holy cow, now they have insight into the industry as a whole.
He described the result of that insight falling into the wrong hands:
And now you know where the brightest minds are or where the best technology is or where all the clinical trial data is and resides.
In biopharma, that information is tied to research that took decades and billions of dollars, to manufacturing capacity the country relies on, and to talent. That combination is why Raduege frames the sector as something a nation state would want, a theme we cover in what nation-state hackers actually want from a biotech.
What happens if the investor does not protect it?
The exposure moves from one company to the sector. If venture capitalists are not protecting the information they have packaged, Raduege said:
Now a national security threat actor, nation state has access to the industry as a whole.
That is also why an investor breach fits the pattern Raduege sees in this year's incidents at large healthcare companies. In our look at the 2026 pharma cyberattacks, he describes adversaries mapping an industry to find its weak points. A diligence file is a map someone has already drawn.
Who is accountable when investor data is stolen?
Raduege cautioned against making one person the scapegoat, which is often the chief information security officer or chief information officer. He said the fairer questions are whether that person warned leadership, asked for funding or advised against a risky setup. In his view accountability ultimately rests with the chief executive, who accepts the risk on behalf of the organization. For a venture firm, that means treating the diligence archive as one of its most sensitive assets. He makes the same case for operating companies in who is responsible for cybersecurity in a biotech.
What should founders and investors do about it?
Raduege’s general advice applies on both sides of a deal: ask where the data is stored, who can reach it, and what someone could do with it. For an investor, that means handling the diligence archive the way the military handles its crown jewels. For a founder, it means asking the same questions about the clinical data and security assessments handed over during a raise.
Companies that want to reach the investors and operators who follow this conversation can learn about sponsoring Open Door Salon.
This post is drawn from the recorded, on-the-record conversation between Lori Ellis and Chad Raduege on Open Door Salon. The Insight Partners incident is described from the firm's own statement, linked above.