Apollo's California filing puts Social Security numbers into the private equity attack wave
The firm says intruders reached its cloud platforms in July and took names, birth dates and Social Security numbers. Google attributes the campaign to BlackFile, a Com affiliate with four extortion brands.
The Watch · Security desk
What happened
- On Aug. 12 the firm concluded that names, dates of birth, contact information, home addresses and Social Security numbers had been compromised.
- It is the first victim in the summer's wave against private equity, law firms, rating agencies and medical technology firms to confirm personal data loss.
- Researchers say Blackstone and Bain Capital were also targeted with malicious infrastructure, with no confirmation that either was compromised.
Why it matters
- What it sets up precedent With one filing on the record naming Social Security numbers, silence from the other targeted firms stops looking like an absence of evidence and starts looking like a determination a regulator...
- What it costs cost A demand opening near $3 million and settling under $1 million is a rounding error against a $1.05 trillion book, so the price of the crime does nothing to discourage the next round of calls, and...
- What it limits constraint Apollo's statement that it has seen no data posted or misused is a measure of what is visible, and against a group that negotiates most demands downward rather than publishing, it cannot carry...
Next story · Invest · 18h ago
General Atlantic targets a first-half 2027 IPO valued at up to $10 billionConfirmed3 publishers
The number the filing does not contain is a detection date. Apollo puts the unauthorized access to its cloud platforms between July 6 and July 10 [2], and says it worked out on August 12 which categories of personal data had been taken [4]. That is 33 days from the last day of access to the determination [16], but Apollo did not say when or how it became aware of the intrusion, and it did not respond to a request for comment [13]. So the 33 days could be forensic reconstruction after a same-week catch, or most of a month of quiet before anyone looked.
Who signed the notice is also informative. It went out under the name of Matthew Breitfelder, Apollo's global head of human capital, and describes law enforcement notification, outside forensic experts, tightened protocols and an investigation [14]. Apollo has not said whose records these are, or how many people are involved [5]. A human capital byline on a notice listing dates of birth and Social Security numbers points toward people on a payroll rather than fund investors, though the company does not say that either.
Google's attribution supplies the name Apollo left out: BlackFile, affiliated with The Com, which recently split its extortion operations into four brands running on shared infrastructure, Redact, Pink, Helix and Falcon [6]. The method underneath the branding is a phone call. The group impersonates IT support in voice-phishing operations and moves from one sector to the next [9], having already worked through healthcare, technology, transportation, logistics, wholesale, and retail and hospitality this year [8]. That sequence is better read as a list of industries whose help desks will act on a convincing caller than as a ranking of whose data is worth having. Private equity, law firms, rating agencies and medical technology companies were the current stop [3].
Home addresses were in Apollo's compromised set [4], and Google has said some of this group's recent victims received threatening messages and faced escalation including swatting, a tactic used across several subsets of The Com [15]. That pairing is not what a credit monitoring enrolment is designed to answer, and it is the part of the filing that has a shelf life longer than the investigation.
What to watch
- Whether Blackstone, Bain Capital, or any targeted law firm or rating agency files a breach notice of its own.
- Whether Apollo's state filings ever put a count of affected individuals on the record.
- Whether Apollo data surfaces on the leak channels of any of the four BlackFile brands: Redact, Pink, Helix or Falcon.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Apollo Global Management confirmed Friday that it was among several financial institutions impacted by a string of social engineering attacks that hit the sector last month.
- [2]
Attackers gained unauthorized access to some of Apollo's cloud platforms between July 6 and July 10, according to a data breach notification the company filed in California.
- [3]
Apollo is the first victim to formally disclose that sensitive personal data under its care was compromised by a wave of attacks that have hit large private equity firms, law firms, financial rating agencies and medical technology companies.
- [4]
Apollo said it determined on Aug. 12 that personal data including names, dates of birth, contact information, home addresses and Social Security numbers were compromised.
- [5]
Apollo did not say how many people were impacted.
- [6]
Apollo did not name the group responsible; Google earlier this month attributed the ongoing campaign to BlackFile, a threat group affiliated with The Com that recently split its extortion operations across four brands with shared infrastructure: Redact, Pink, Helix and Falcon.
- [7]
Apollo said it has so far found no evidence that any data was posted online or used for identity theft or fraud.
- [8]
BlackFile and its affiliates have impacted organizations in multiple industries including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.
- [9]
The extortion group shifts from one sector to the next, impersonating IT support in voice-phishing and social-engineering attacks before threatening alleged victims with extortion demands.
- [10]
The group's extortion demands often start around $3 million and are typically negotiated down to less than $1 million.
- [11]
Apollo had $1.05 trillion in assets under management at the end of June, according to a regulatory filing.
- [12]
Researchers previously told CyberScoop that some of Apollo's largest competitors, including Blackstone and Bain Capital, were also targeted with malicious infrastructure, but it is unclear whether those firms were compromised.
- [13]
Apollo did not say when or how it became aware of the intrusion, and did not respond to a request for comment.
- [14]
The disclosure notice was written by Matthew Breitfelder, Apollo's global head of human capital, who said the company promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced its security protocols and launched an investigation.
- [15]
Google researchers previously said some of the group's recent victims have been subject to threatening messages and other forms of escalation, including swatting incidents, a tactic adopted by several subsets of The Com.
- [16]
There were 33 days between the last day of unauthorized access Apollo reported, July 10, and the Aug. 12 determination of which personal data was compromised.
- [17]
A typical negotiated settlement of under $1 million equals roughly 0.0001 percent, about one ten-thousandth of one percent, of Apollo's $1.05 trillion in assets under management.
Sources
2 independent publishers whose own reporting we read for this story.
- cyberscoop.comApollo discloses data breach from ongoing wave of attacks hitting financial sector
1 article · August 21, 2026
- securityweek.comPersonal Information Exposed in Apollo Global Data Breach
1 article · August 24, 2026
Topics and entities
Entities
- BlackFile
- Google Threat Intelligence Group
- Apollo
- Blackstone
- Bain Capital
- The Com
- Matthew Breitfelder