Apollo Global Management Confirms Cloud Data Breach After Intruder Accesses Systems July 6-10

Apollo breach confirmed

Apollo Global Management confirmed a data breach after an intruder accessed its cloud systems and removed a large cache of personal data, with the unauthorized access spanning July 6 through July 10. In a filing with California regulators, Apollo said the attack relied on deception tactics rather than a technical exploit, and the letter signed by Apollo Global Head of Human Capital Matthew Breitfelder described a social-engineering approach to get into Apollo’s cloud environment.

Reuters reported that Apollo’s investigation found unauthorized access to certain cloud platforms between July 6 and July 10, and that the firm notified law enforcement and engaged outside cybersecurity and forensic experts. The information potentially impacted included names, dates of birth, contact information, home addresses, and social security numbers, according to Reuters and the notice described by Benzinga.

Reporting for this sectionReutersBenzinga

Social engineering and vishing

Google security researchers warned of an extortion-focused campaign aimed at private equity and major financial firms, saying operators used multiple monikers including Falcon, Helix, Pink and Redact.

Google Principal Threat Analyst Austin Larsen told Reuters, "Really, it’s a money thing," and added, "Sophisticated is not the right word. It is just really effective."

The Reuters report said internet intelligence data reviewed by Reuters showed hackers devised websites aimed at stealing passwords from employees of private equity firms and financial companies.

Benzinga said the attackers used a social engineering strategy known as “vishing,” calling employees on personal phones while pretending to be internal IT staff to capture passwords and multi-factor authentication codes via fake sign-in pages.

Reporting for this sectionReutersBenzinga

Targets, assets, and fallout

Apollo said its investigation remains ongoing and the firm hasn’t found evidence that stolen information has been publicly posted or used for identity theft or fraud at this time, while affected individuals are being offered complimentary third-party identity protection and credit monitoring services. Reuters reported that cybercriminals built digital traps for hundreds of companies recently, including ride-hailing company Uber and jeans brand Levi Strauss, and that Apollo’s breach was part of a broader wave of ransom-seeking hackers using phone calls.

TechCrunch said Apollo is one of the world’s largest private equity firms with $938 billion in assets under its management, and it reported that Apollo has around 5,000 employees as of February 2026. ClassAction.org said a class action lawsuit could be possible if your information was compromised, and it described a sample notice letter stating Apollo determined there was unauthorized access to certain cloud platforms between July 6 and 10, 2026.

Reporting for this sectionReutersTechCrunch