Apollo Global Management has confirmed that hackers stole sensitive personal information from its cloud environment, turning what had been one of many attempted attacks against Wall Street into a confirmed breach at one of the world’s largest private-equity firms.
TechCrunch reports that attackers used a social engineering attack to access Apollo’s cloud environment between July 6 and July 10, stealing names, birth dates, contact details, home addresses and Social Security numbers. Apollo manages approximately $938 billion in assets and had around 5,000 employees as of February 2026.
The New York Post reports that Apollo was among a much wider group of financial firms targeted through a campaign in which attackers called employees while impersonating corporate IT help desks, directing victims toward fake login sites designed to capture passwords and real-time authentication codes.
Apollo Confirms What Was Previously an Uncertain Target
Apollo disclosed the incident in a letter filed with California’s attorney general.
TechCrunch says Apollo human resources chief Matthew Breitfelder confirmed that the attackers gained access to the company’s cloud environment, although the disclosure did not identify whether the stolen information belonged to Apollo employees or people working at companies in its investment portfolio.
Weeks earlier, the New York Post reported that Apollo, Blackstone, Bridgewater Associates, Bain Capital, KKR, TPG, CME Group, Clearlake Capital and Moody’s were among firms targeted, but Reuters had then been unable to establish which companies had actually been compromised.
Apollo’s confirmation now establishes that at least one major target suffered a successful intrusion.
Attackers Bypassed Security by Targeting Employees
The campaign is notable because its defining technique is not a sophisticated software exploit.
Attackers used an “old fashioned” approach: calling employees while pretending to represent internal help desks, sometimes spoofing company phone numbers and sending victims to fake sites such as “passkeyhelpdesk” to steal credentials and two-factor authentication codes.
Google tracks the attackers under names including Falcon, Helix, Pink and Redact, and says they rely heavily on calls impersonating IT support to persuade employees to enter passwords and multifactor-authentication codes into spoofed portals.
For security engineering teams, that shifts the problem toward identity infrastructure. Strong cloud platforms and perimeter defenses become less useful when an attacker convinces an authorized employee to provide the credentials needed to enter legitimately.
More Than 200 Companies Were Put in the Attackers’ Sights
The campaign extends well beyond private equity.
Attackers built digital traps targeting more than 200 companies over five weeks, including financial firms as well as Uber, Zillow, Levi Strauss and law firms Paul Hastings and Greenberg Traurig. It also says Point72, Two Sigma and Citadel were targeted as the campaign generated concern across Wall Street.
Once data is stolen, the attackers threaten to publish it unless victims pay, with Google saying some ransom payments reached as much as $750,000. Apollo spokesperson Giovanna Falbo did not answer TechCrunch’s question about whether Apollo paid a ransom.
Identity Has Become Critical Financial Infrastructure
The Apollo breach provides a useful signal for founders and security teams building enterprise defenses.
Financial companies have spent heavily protecting networks, endpoints and cloud workloads, yet this campaign attacks the layer that ultimately grants access to all three: employees and their identities.
As Lee Clark, a cyberthreat intelligence manager cited by the New York Post, put it, attackers increasingly try to “trick the guard into opening the door.”
Apollo’s breach suggests the next security investment cycle for high-value financial organizations cannot focus only on stronger technical walls. It also has to make help-desk impersonation, credential phishing and real-time MFA theft substantially harder to turn into cloud access.
For cybersecurity builders, that makes identity verification and phishing-resistant authentication less of an IT feature and more of a core piece of financial infrastructure.
