Apollo Global Management, one of the world's largest private equity firms, has confirmed that attackers social-engineered their way into "certain cloud platforms" and stole names, dates of birth, contact information, home addresses and Social Security numbers. The confirmation came in a data breach notification filed with the California attorney general's office, dated August 21, 2026 and signed by Matthew Breitfelder, Apollo's global head of human capital. Unauthorized access ran from July 6 to July 10, a four-day window. Apollo has not said how many people are affected, who they are, which cloud platforms were touched, or how the attackers got in beyond the phrase "social engineering incident." CyberScoop notes that Apollo is the first victim to formally disclose that sensitive personal data was compromised in a wave of attacks that has hit private equity firms, law firms, financial rating agencies and medical technology companies since the summer.
What Happened
The notification letter opens with a comparison that does most of the contextual work: "Similar to other financial services firms, Apollo recently experienced a social engineering incident." From there the timeline is thin but consistent across every account.
Attackers had unauthorized access to certain Apollo cloud platforms between July 6 and July 10, 2026. Apollo says that "upon detecting the incident, we promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced our security protocols, and launched an investigation." What the company has never said is when or how it detected the intrusion, a gap CyberScoop flagged explicitly. On August 12 the investigation determined that personal information had been potentially impacted. The notice went out on August 21. Roughly six weeks separate the first day of access from the letter reaching individuals, and TechNext reports the letter tells California and Wyoming residents that "this notification was not delayed by law enforcement," which rules out the usual explanation for that gap.
Apollo did not name the threat actor. It declined to comment to TechCrunch on the incident, including on whether a ransom was paid, and declined to comment to Bloomberg.
One factual discrepancy worth noting for anyone sizing the target: TechCrunch puts Apollo's assets under management at $938 billion, while CyberScoop, SecurityWeek and The Register all cite $1.05 trillion as of the end of June, per a regulatory filing. The trillion-dollar figure is the more recent and more widely corroborated one. TechCrunch also reports Apollo had around 5,000 employees as of February 2026, drawing on public regulatory filings, which is the only rough bound available on victim count and only if the affected population turns out to be staff.
What Was Taken
The categories are consistent across the sources, because they all come from the same notification letter: name, date of birth, contact information, home address, and Social Security number. SecurityWeek's summary lists names, contact information and SSNs; the fuller list including dates of birth and home addresses appears in CyberScoop, The Register, TechCrunch, CNA and TechNext.
That combination is the full identity-theft kit. An SSN paired with a legal name, date of birth and current residential address is enough to open credit lines, file fraudulent tax returns, or pass knowledge-based authentication at institutions that still use it.
On volume, there is no number. Not a range, not an order of magnitude. Every source states plainly that Apollo did not disclose how many individuals were affected, and none of them offer an independent estimate. The letter also does not say who the recipients are: Apollo employees, staff at portfolio companies Apollo owns, or investors. Treat any figure circulating elsewhere as unsourced until Apollo or a regulator publishes one.
Apollo says it has so far found no evidence that the compromised information was publicly posted or used for identity theft or fraud. Affected individuals are being offered identity protection and credit monitoring; The Register specifies 24 months of coverage, while SecurityWeek reports the offer without a duration.
Why It Matters
This breach is the first confirmed data compromise in a campaign that security researchers have been warning about since July, and that changes the risk calculus for everyone else on the target list.
Google warned weeks before Apollo's disclosure that an extortion-focused crew was targeting private equity and financial-sector companies. Reuters reported at the time that Apollo was among the targeted firms, alongside Blackstone, Bridgewater and Bain Capital, but that it was unclear whether any of the attacks had succeeded. SecurityWeek's fuller target list, compiled from observed phishing infrastructure, domain registrations and reported intrusion attempts, adds KKR, TPG, Clearlake Capital and CME Group, plus hedge funds Point72, Citadel, Two Sigma and Millennium Management. SecurityWeek is explicit that this list reflects targeting, not compromise, and that public disclosures confirm a successful data compromise only in Apollo's case. Do not read those names as a victim list.
Three things make this significant beyond one firm's notification. First, the attack path bypassed technology entirely at the entry point: a human being was talked into granting access. Second, the target was the cloud environment, where a single set of federated credentials can unlock HR systems, document stores and collaboration platforms simultaneously. Third, the dwell time was short. Four days is not a patient espionage operation; it is a smash-and-grab optimized for bulk data extraction, which is consistent with an extortion business model.
CNA's reporting makes the strategic point bluntly: low-tech tactics such as phone calls to target the financial industry still rank among the most effective ones, despite the emergence of sophisticated security programs and AI-driven threats.
The Attack Technique
Apollo itself says only "social engineering incident." Everything more specific comes from researchers describing the wider campaign, and should be read as strong circumstantial context rather than confirmed attribution for this particular intrusion.
Google attributed the ongoing campaign to a threat group tracked as BlackFile, also designated UNC6671, which CyberScoop describes as affiliated with The Com. The group recently split its extortion operations across four brands running on shared infrastructure: Redact, Pink, Helix and Falcon. TechCrunch reports Google's assessment that the actors behind those names rely largely on social engineering attacks.
SecurityWeek adds operational detail: the group emerged in early 2026 and has been using IT helpdesk-themed vishing attacks against organizations across North America, Australia and the United Kingdom, recently rebranding and diversifying into private equity, financial services and professional services. TechRepublic describes reporting on the wider campaign that found attackers impersonating IT support personnel and using phishing pages to harvest credentials and authentication information, which could then be used to access corporate cloud environments. CNA reports that internet intelligence data reviewed by Reuters showed hackers had built websites designed to steal passwords from employees of private equity firms and financial companies.
The composite picture, then, is a voice call impersonating internal IT, steering the target to a credential-harvesting page that also captures the MFA response, followed by session or token abuse inside the cloud tenant. That is the campaign's known playbook. Apollo has not confirmed it applies here, and has named no cloud platform.
What Organizations Should Do
- Harden the help desk, not just the endpoint. Require out-of-band identity verification before any password reset, MFA re-enrollment or device registration: a callback to the number on record, manager attestation, or a video check against an HR photo. Every intrusion in this campaign starts at that conversation. Write the rule down and test it with unannounced calls.
- Move to phishing-resistant MFA. FIDO2 security keys or platform passkeys defeat the real-time proxy phishing pages described in this campaign in a way that push notifications and one-time codes do not. Prioritize accounts with access to HR, payroll and identity systems, which is where SSN-bearing data lives.
- Shorten the blast radius of a stolen session. Enforce short token lifetimes, bind sessions to device and network posture where your identity provider supports it, restrict OAuth application consent to admin approval, and alert on new refresh tokens issued from unfamiliar geographies or ASNs.
- Instrument your cloud tenants for bulk egress. The distinguishing signal of a four-day extortion grab is volume: mass file downloads, unusual report exports, sudden SharePoint or Drive enumeration, new data-export API calls. Baseline normal volumes per user and alert on deviation, then rehearse the containment action so it takes minutes rather than days.
- Monitor for lookalike domains targeting your staff. Reuters-reviewed data showed purpose-built credential-theft sites for private equity employees. Standing certificate-transparency and domain-registration monitoring for permutations of your brand, plus your help desk and SSO hostnames, gives early warning before the calls start.
- Reduce standing access to identity data. Apply data minimization and retention limits to SSN-bearing records, gate them behind just-in-time privileged access, and apply DLP controls on bulk retrieval. If the crown jewels cannot be exported in one session, a four-day intrusion yields far less.
- Assume peer targeting. If your firm is in private equity, hedge funds, professional services or financial ratings, treat the SecurityWeek target list as a statement about sector interest rather than about specific companies, and hunt retroactively across July for vishing reports, anomalous MFA enrollments and unfamiliar cloud sessions.
Sources: Private equity giant Apollo confirms data breach saw ... | Private equity firm Apollo confirms data breach amid ... | Apollo discloses data breach from ongoing wave of attacks hitting f... | Personal Information Exposed in Apollo Global Data Breach | $1T investment giant Apollo breached after social ... | Apollo Confirms Data Breach Amid Cyberattacks Targeting Financial F... | Apollo Global reveals data breach after hackers target financial fi... | Apollo blames social engineering for a four-day breach in ...