Apollo Global Management has confirmed that attackers broke into some of its cloud platforms between July 6 and July 10, compromising sensitive personal data. It is the first firm to formally confirm that sensitive data was lost in the campaign, which has also touched law firms, rating agencies, and medical technology companies.
According to a breach notification filed in California, the firm learned on August 12 that names, birth dates, contact details, home addresses, and Social Security numbers had been exposed. No victim count has been released. Apollo says it has seen no sign the records were published or used for fraud.
Apollo did not name the attackers. Google earlier this month attributed the ongoing wave to BlackFile, an extortion group whose affiliates impersonate IT support in voice phishing and social engineering campaigns before demanding ransoms that often start around $3M and are typically negotiated below $1M. Some victims have also faced swatting incidents.
The firm manages roughly $1.05T in assets, one of the largest pools in private equity. Researchers previously told CyberScoop that rivals Blackstone and Bain Capital were also targeted, though it remains unclear whether they were breached.
