Key Takeaways
- • Apollo Global Management confirmed that hackers stole personal data including full names, dates of birth, contact details, home addresses, and Social Security numbers during a breach between July 6–10, 2026, discovered on August 12 and disclosed August 21.
- • Apollo is the first alternative asset manager caught in a summer 2026 wave of social engineering attacks on private equity and financial firms to publicly confirm actual data theft rather than merely reporting system probing or access attempts.
- • The intrusion was accomplished via social engineering tactics; Apollo has not disclosed the specific attack vector but has notified law enforcement, engaged outside cybersecurity and forensic experts, and found no evidence to date that stolen data has been posted online or used fraudulently.
- • Apollo is offering affected individuals complimentary credit monitoring and identity protection services, though the firm has not yet disclosed the total number of impacted individuals or whether compromised records belong to employees, portfolio company staff, or other categories.
- • The breach is part of a broader extortion campaign targeting private equity firms and financial institutions that security researchers flagged weeks prior, expanding the systemic risk surface across the alternative asset management industry.
Summary
Apollo Global Management disclosed on August 21, 2026, that unauthorized actors gained access to its cloud-based systems and successfully exfiltrated personal data during a social engineering attack conducted between July 6 and July 10. The firm filed notice with the California attorney general's data breach registry, making it the first major alternative asset manager in the current wave of attacks to formally confirm actual data theft rather than reporting system access without confirmed exfiltration. Matthew Breitfelder, Apollo's global head of human capital, signed the notification letter detailing the incident.
The compromised personal information includes full names, dates of birth, contact details, home addresses, and Social Security numbers. Apollo stated it did not identify the specific categories of stolen data until August 12—two days before the California filing—following completion of its forensic investigation. Notably, the firm has not disclosed the total number of individuals affected or clarified whether the exposed records belong to employees, portfolio company stakeholders, or other parties within its ecosystem.
The attack exemplifies a broader extortion campaign targeting private equity firms and financial institutions that security researchers had flagged weeks in advance. Apollo's breach represents a meaningful escalation in the threat landscape, as the firm is the first to explicitly confirm material data theft amid this summer's coordinated wave of social engineering attacks on Wall Street and alternative asset management platforms. The intruders employed social engineering techniques to penetrate Apollo's defenses; the exact methodology has not been disclosed.
In response, Apollo moved quickly to contain the breach, notifying law enforcement and engaging outside cybersecurity and forensic specialists. The firm reports no evidence to date that the stolen data has been posted to public forums, sold on dark markets, or used for active fraud campaigns. To mitigate downstream risk to affected individuals, Apollo is offering complimentary credit monitoring and identity protection services. The disclosure underscores growing vulnerability in the alternative asset management industry to targeted social engineering campaigns and highlights the operational and reputational risks associated with cloud-based infrastructure within firms managing substantial capital and sensitive stakeholder information.
The compromised personal information includes full names, dates of birth, contact details, home addresses, and Social Security numbers. Apollo stated it did not identify the specific categories of stolen data until August 12—two days before the California filing—following completion of its forensic investigation. Notably, the firm has not disclosed the total number of individuals affected or clarified whether the exposed records belong to employees, portfolio company stakeholders, or other parties within its ecosystem.
The attack exemplifies a broader extortion campaign targeting private equity firms and financial institutions that security researchers had flagged weeks in advance. Apollo's breach represents a meaningful escalation in the threat landscape, as the firm is the first to explicitly confirm material data theft amid this summer's coordinated wave of social engineering attacks on Wall Street and alternative asset management platforms. The intruders employed social engineering techniques to penetrate Apollo's defenses; the exact methodology has not been disclosed.
In response, Apollo moved quickly to contain the breach, notifying law enforcement and engaging outside cybersecurity and forensic specialists. The firm reports no evidence to date that the stolen data has been posted to public forums, sold on dark markets, or used for active fraud campaigns. To mitigate downstream risk to affected individuals, Apollo is offering complimentary credit monitoring and identity protection services. The disclosure underscores growing vulnerability in the alternative asset management industry to targeted social engineering campaigns and highlights the operational and reputational risks associated with cloud-based infrastructure within firms managing substantial capital and sensitive stakeholder information.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.