Apollo Global Management, a major private equity firm, has confirmed it experienced a data breach in July, impacting some of its cloud platforms. The company disclosed that sensitive personal data, including names, dates of birth, contact information, home addresses, and Social Security numbers, was compromised during the incident.
The breach occurred between July 6 and July 10, according to a data breach notification filed in California. Apollo stated that it became aware of the intrusion and promptly notified law enforcement, engaged external cybersecurity and forensic experts, and enhanced its security protocols. The ongoing investigation determined on August 12 that personal data had been compromised.
While Apollo did not specify the number of individuals affected, it noted that there is currently no evidence of the data being posted online or used for identity theft or fraud. The firm, which manages $1.05 trillion in assets, is the first to formally disclose a personal data compromise stemming from a series of social engineering attacks targeting the financial sector.
Google has attributed the ongoing campaign to BlackFile, a threat group affiliated with "The Com." This group has reportedly split its extortion operations across four brands—Redact, Pink, Helix, and Falcon—which share infrastructure. BlackFile and its affiliates have impacted organizations across various industries, including healthcare, technology, transportation, logistics, wholesale, retail, and hospitality, since the beginning of the year.
The attackers typically employ voice-phishing and social engineering tactics, often impersonating IT support, before issuing extortion demands. These demands frequently begin around $3 million but are often negotiated down to less than $1 million. Google researchers have also reported that some recent victims of the group have faced threatening messages and other forms of escalation, including swatting incidents.
While Apollo did not name the responsible group, its disclosure places it among several financial institutions believed to have been targeted in this wave of attacks. Other large private equity firms, law firms, financial rating agencies, and medical technology companies have also reportedly been affected. Previous reports indicated that some of Apollo's competitors, such as Blackstone and Bain Capital, were targeted with malicious infrastructure, though it remains unconfirmed if those firms were compromised.
