Apollo Global Management Confirms Cloud Data Breach in Social Engineering Campaign

Apollo Global Management has confirmed a data breach in which hackers stole personal information from its cloud systems, according to a letter filed with California's attorney general on August 21, 2026. Apollo's human resources chief, Matthew Breitfelder, stated that hackers used a social engineering attack to gain access to the company's cloud environment between July 6 and July 10, 2026. The stolen data included names, birth dates, contact information including home addresses, and Social Security numbers. Apollo spokesperson Giovanna Falbo did not provide comment when reached by TechCrunch about the incident. The breach at Apollo, one of the world's largest private equity firms with $938 billion in assets under management and roughly 5,000 employees as of February 2026, did not occur in isolation. It is part of a broader extortion campaign tracked as UNC6671, in which hackers have targeted private equity companies and financial giants. Google researchers warned that the attackers rely largely on social engineering techniques, specifically tricking employees into entering passwords and multi-factor authentication codes in spoofed login portals. Reuters reported that Apollo was among companies targeted alongside Blackstone, Bridgewater, Bain Capital, and others. Hackers built 72 malicious websites targeting employees at firms including Blackstone, Apollo, and KKR. Google's security researchers reported that hackers are calling employees of large U.S. financial firms directly to steal sensitive data and extort victims. Some of the attacks netted the attackers ransoms as much as $750,000, according to Google. Law firm Greenberg Traurig, also reportedly targeted, released a statement saying its security protocols successfully protected client data and prevented a data breach. Google's threat intelligence researchers attributed the activity to hackers known by names including Falcon, Helix, Pink, and Redact. While the Mandiant M-Trends 2026 report found the high-tech sector overtook finance as the top target of cyberattacks, accounting for 17% of all Mandiant investigations in 2025, the UNC6671 campaign demonstrates a continued, focused threat against financial services and enterprise cloud environments. The report covers cyber threats including ransomware recovery denial and extreme persistence. Until 2025, TechCrunch was a subsidiary of Yahoo, an advertising technology company owned by Apollo. The UNC6671 campaign's reliance on social engineering rather than novel exploit chains is worth flagging for security teams. The attack vector that compromised Apollo's cloud environment, a social engineering attack resulting in stolen MFA codes, bypasses the credential protections that many enterprises treat as sufficient. The technique requires minimal zero-day investment from attackers. Spoofed login portals and direct phone calls to employees are effective because they exploit human trust at the access layer. The successful exfiltration of Social Security numbers and home addresses from a firm of Apollo's scale creates a downstream risk profile that extends well beyond Apollo's internal operations. Employees whose data was stored in Apollo's cloud systems face potential identity theft, and the combination of Social Security numbers, birth dates, and home addresses provides a foundation for targeted phishing and fraud campaigns that could persist for months or years. For technology professionals managing cloud security in regulated industries, the Apollo breach and the broader UNC6671 campaign reinforce the need for controls beyond MFA. Phishing-resistant authentication, continuous monitoring for anomalous cloud access, and employee training that accounts for direct voice contact are all measures that can reduce the attack surface. The ransom payments of up to $750,000 reported by Google indicate the campaign is economically viable for the attackers, which increases the likelihood of continued targeting. The fact that a private equity firm with $938 billion in assets under management was compromised through social engineering techniques rather than a sophisticated technical exploit is a reminder that the weakest link in any security architecture remains the human element. That a firm with Apollo's resources was vulnerable should give pause to smaller organizations with thinner security budgets. Google's research on UNC6671 and the broader pattern of attacks on financial firms provides a useful threat intelligence baseline, but the operational reality is that social engineering campaigns adapt quickly to defensive measures. The malicious websites built to target employees at Blackstone, Apollo, and KKR were likely designed to mimic legitimate authentication flows closely enough to deceive even technically sophisticated users. The successful breach at Apollo and the reported ransoms collected from other targets suggest the attackers behind UNC6671 have found a repeatable formula. Until financial services firms and private equity companies close the gap between MFA implementation and phishing-resistant authentication, campaigns like UNC6671 will continue to find victims.