Apollo's 5-Day Cloud Intrusion Exposes SSNs, Names, DOBs

Security teams should read Apollo's breach as a modern financially motivated intrusion playbook: attackers relied on phone-based social engineering and credential-harvesting websites targeting private equity employees, not zero-day exploits. The July 6–10 cloud access window demonstrates how stolen credentials can translate into multi-day dwell time before containment. With Social Security numbers in the exposed dataset, this is a high-severity PII incident that demands lessons for identity and access management.

Apollo Global Management confirmed on Friday, Aug. 21, 2026, that hackers stole personal information during a five-day intrusion into certain cloud platforms between July 6 and July 10. The New York-based alternative asset manager disclosed in a letter from Global Head of Human Capital Matthew Breitfelder that the potentially impacted data included names, dates of birth, contact information, home addresses, and Social Security numbers. The firm has notified law enforcement and engaged outside cybersecurity and forensic experts to investigate. As of the disclosure, Apollo said it had not found evidence that the stolen information had been publicly posted or used for identity theft or fraud.

“

Apollo Global Management confirmed on Friday, Aug.

The breach at Apollo is one node in a broader campaign against financial institutions and other high-profile companies. Reuters reported earlier in August that dozens of prominent U.S. financial institutions and businesses were targeted by ransom-seeking hackers who use phone calls to compromise victims. Internet intelligence reviewed by Reuters showed that the attackers built websites designed to steal passwords from employees of private equity firms and financial companies. Uber Freight and Levi Strauss said earlier this month they were investigating cybersecurity incidents involving unauthorized access to their systems, underscoring the breadth of the campaign.

What stands out from a security standpoint is the relatively low-tech nature of the initial compromise. Even as firms invest in sophisticated security programs and grapple with AI-driven threats, phone-based social engineering remains among the most effective intrusion methods, according to experts. Attackers can use vishing calls to persuade employees to reveal credentials or approve multi-factor authentication requests, then pivot into cloud platforms where sensitive data resides. Apollo's five-day access window from July 6 through July 10 suggests meaningful dwell time before the unauthorized access was contained, though the company has not specified exactly when the intrusion was detected.

The data involved makes this a high-severity personal information incident rather than a routine exposure. Social Security numbers, combined with names, birth dates, contact details, and home addresses, provide everything needed for identity theft and targeted fraud. Apollo is offering affected individuals complimentary third-party identity protection and credit monitoring, which is standard practice for breaches involving this class of data. The costs of forensic investigation, notification, legal review, and identity protection services can run into the millions even before any regulatory fines or litigation.