Apollo Global Management

Summary

Apollo Global Management disclosed that attackers used social engineering to gain unauthorized access to certain cloud platforms for four days, compromising names, dates of birth, contact details, home addresses and Social Security numbers. The firm detected the intrusion, notified law enforcement, engaged external cybersecurity experts and launched an investigation, later informing affected individuals through a letter filed with the California attorney general’s office. Notification was sent approximately six weeks after the access period, offering twenty‑four months of complimentary credit monitoring and identity protection services via a third‑party provider, with enrollment required within ninety days of receipt. The firm stated there is no evidence the stolen data has been posted publicly or used for identity theft or fraud, and the investigation remains ongoing.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 6, 2026, unauthorized access to certain cloud platforms used by Apollo Global Management began, and the intrusion continued until July 10, 2026. The firm learned on August 12, 2026 that the potentially compromised information included names, dates of birth, contact details, home addresses, and Social Security numbers. No payment card or bank account data were reported as part of the exposed data. Apollo’s investigation found no evidence that the stolen information had been publicly posted or used for identity theft or fraud at the time of notification. A notification letter dated August 21, 2026 was filed with the California attorney general’s office and sent to affected individuals six weeks after the initial access.

Upon detecting the incident, Apollo promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced its security protocols, and launched an investigation that remained ongoing. The notification letter explained that the firm was offering complimentary credit monitoring and identity protection services through Cyberscout, a TransUnion company, with coverage lasting twenty‑four months from the date of enrolment. Recipients had ninety days from the letter to enrol, required an internet connection and an email account, and the service was not available to minors under eighteen years of age; a help line operated weekdays from 8 a.m. to 8 p.m. Eastern time for ninety days. The letter was distributed to residents of seven jurisdictions—California, the District of Columbia, Maryland, New York, North Carolina, Rhode Island, and Wyoming—and informed Rhode Island recipients that they could obtain any police report filed about the incident. The letter did not identify the attacker, specify the number of individuals affected, or clarify whether the affected parties were employees, investors, or persons associated with portfolio companies.

Apollo Global Management reported approximately $938 billion in assets under management and a workforce of around 5,000 employees as of February 2026. The breach occurred amid a broader increase in social engineering targeting financial and private equity firms, a trend noted by security researchers a month prior to the incident. Google’s Threat Intelligence Group had warned in July 2026 about a group tracked as UNC6671 (also known as BlackFile) that was targeting private equity and financial firms with voice‑phishing tactics; Reuters reported that Apollo was among the companies named in that warning, although Apollo has not attributed its breach to that group. Similar incidents were reported elsewhere in August 2026, including a social engineering compromise at Levi Strauss that affected three employees’ computers, a phone‑call breach at RingCentral that exposed 1.6 million records, and disclosures from Point72, Millennium Management, Two Sigma, and Citadel of attempted or successful intrusions. A Gigamon survey cited in the coverage indicated that 54 % of financial services organizations had observed a rise in AI‑powered social engineering attacks, and among those that suffered a breach, 98 % reported material business impact such as financial losses, operational disruption, or data loss.

Sources

Sources available to members: 8 sources.