Key Takeaways
- • Apollo Global Management, managing approximately $1.05 trillion in assets, disclosed a data breach affecting personal information between July 6–10, 2026, following a social engineering attack on cloud platforms.
- • Compromised data includes names, contact information, dates of birth, and Social Security numbers; the company found no evidence that stolen information was made public or used for fraud to date.
- • The attack has been attributed to UNC6671 and BlackFile, a cybercrime group that emerged in early 2026 and specializes in IT helpdesk-themed vishing attacks targeting North America, Australia, and the UK.
- • BlackFile's recent campaign has targeted major private equity and financial services firms including Blackstone, Bain Capital, KKR, TPG, and hedge funds such as Citadel, Point72, Two Sigma, and Millennium Management, indicating a coordinated industry-wide threat.
- • Apollo is offering affected individuals identity protection and credit monitoring services; the company has not disclosed the total number of individuals impacted by the breach.
Summary
Apollo Global Management confirmed a significant data breach in August 2026 following unauthorized access to portions of its cloud infrastructure during a four-day window in early July. The breach resulted from a social engineering attack, specifically vishing tactics targeting IT helpdesk functions. According to the company's breach notification to affected individuals, personal information was compromised, including full names, dates of birth, contact information, and Social Security numbers. The firm has stated that no evidence exists indicating the stolen data was publicly disclosed or used for fraudulent purposes, though an investigation remains ongoing.
The attack is attributed to UNC6671 and BlackFile, a cybercrime group that emerged in early 2026 and has rapidly become a significant threat to the financial services and private equity sectors. The group employs IT helpdesk-themed vishing campaigns to exploit employees and gain initial access to organizational networks. BlackFile has recently rebranded and diversified its operations while expanding its targeting scope across North America, Australia, and the United Kingdom. The firm's latest campaign demonstrates clear sector specialization, with emphasis on private equity, financial services, and professional services industries.
The breadth of BlackFile's targeting is notable for institutional investors and asset managers. Beyond Apollo, the threat actor has conducted observed phishing infrastructure campaigns and documented intrusion attempts against major competitors including Blackstone, Bain Capital, KKR, TPG, Bridgewater Associates, Clearlake Capital, and CME Group. Hedge fund targets have included Point72, Citadel, Two Sigma, and Millennium Management. This list reflects either confirmed breaches or documented targeting attempts; not all targeted organizations have necessarily suffered successful intrusions.
In response to the breach, Apollo is providing affected individuals with identity protection and credit monitoring services. However, the company has not disclosed the total number of individuals impacted, limiting visibility into the breach's full scope. The incident underscores the vulnerability of large financial institutions to coordinated social engineering campaigns and highlights an industry-wide operational risk for asset managers and private equity firms managing substantial client assets and sensitive employee data.
The attack is attributed to UNC6671 and BlackFile, a cybercrime group that emerged in early 2026 and has rapidly become a significant threat to the financial services and private equity sectors. The group employs IT helpdesk-themed vishing campaigns to exploit employees and gain initial access to organizational networks. BlackFile has recently rebranded and diversified its operations while expanding its targeting scope across North America, Australia, and the United Kingdom. The firm's latest campaign demonstrates clear sector specialization, with emphasis on private equity, financial services, and professional services industries.
The breadth of BlackFile's targeting is notable for institutional investors and asset managers. Beyond Apollo, the threat actor has conducted observed phishing infrastructure campaigns and documented intrusion attempts against major competitors including Blackstone, Bain Capital, KKR, TPG, Bridgewater Associates, Clearlake Capital, and CME Group. Hedge fund targets have included Point72, Citadel, Two Sigma, and Millennium Management. This list reflects either confirmed breaches or documented targeting attempts; not all targeted organizations have necessarily suffered successful intrusions.
In response to the breach, Apollo is providing affected individuals with identity protection and credit monitoring services. However, the company has not disclosed the total number of individuals impacted, limiting visibility into the breach's full scope. The incident underscores the vulnerability of large financial institutions to coordinated social engineering campaigns and highlights an industry-wide operational risk for asset managers and private equity firms managing substantial client assets and sensitive employee data.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.