Using a unique data set, we provide the first comprehensive evidence of trading before successful cyberattacks. Although only hackers should expect an imminent breach, short selling in victim firms intensifies a few weeks earlier—particularly when shares are widely lendable—whereas insider and institutional trades remain flat. Retail investors, ostensibly the least informed, likewise presciently divest/short soon-to-be-attacked stocks, coinciding with spikes in “<company-name>+hacking” Google queries and rising trading/short costs. Post-cyberattack, victims earn negative returns—implying a wealth transfer far exceeding widely-publicized ransom demands. Therefore, cyberattacks—the tip of iceberg of outsider-generated information—undermine the traditional paradigm of insider-centric information asymmetry.