Apollo Global Management has disclosed a July cyber incident in which attackers gained unauthorized access to cloud platforms and potentially obtained highly sensitive personal information.
The New York-based alternative asset manager said the intrusion occurred between July 6 and July 10 after a social-engineering attack.
According to the company’s breach notification, the threat actors used social engineering to access its cloud environment. Apollo has not publicly attributed the activity to a named group or detailed the precise initial-access mechanism.
Apollo Global Data Breach
The identified data categories create a material identity theft risk. A name, birth date, address and Social Security number can be used to support fraudulent account applications, targeted impersonation and convincing phishing campaigns.
Home address and contact data can also help attackers tailor lures that appear to originate from employers, banks, insurers, or government bodies.
Apollo said it found no evidence that the information had been publicly posted or used for identity theft or fraud at the time of notification.
The absence of public evidence, however, should not be treated as confirmation that data has not been copied, traded privately, or retained for later abuse.
Investigations into cloud account compromise often evolve as log analysis, endpoint evidence, and third-party intelligence become available.
The firm said it notified law enforcement, retained outside cybersecurity and forensic specialists, and strengthened security measures. It is offering affected individuals 24 months of complimentary credit monitoring and identity protection services.
The notification did not specify how many people were affected or clearly identify whether the records belonged to employees, applicants, investors, portfolio-company personnel or other contacts.
Apollo has not disclosed a confirmed count of people affected while its investigation continues. For security teams, the incident reinforces the need to harden identity and cloud-administration workflows.
Organizations should require phishing-resistant multi-factor authentication for privileged accounts, restrict and monitor help desk password resets, verify identity through out-of-band procedures, and alert on anomalous cloud session activity.
According to the breach notification, High-risk changes, including MFA device enrolment, recovery email updates, and privileged role assignments, should trigger a rapid review.
Individuals who receive an Apollo notice should activate the offered monitoring, consider placing a credit freeze with major bureaus, review account activity, and remain alert for unsolicited calls or messages requesting credentials, one-time codes, or personal data.
They should independently contact an institution using a known number rather than following links or phone numbers supplied in an unexpected message.
The breach also illustrates a broader defensive reality: cloud platforms can be well configured yet still exposed when attackers successfully impersonate trusted users.
Identity verification, least privilege and rapid detection of account-recovery abuse remain essential controls for financial firms handling concentrated stores of high-value personal data.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
