Apollo Global discloses data breach after hacker attacks on financial firms

• Unauthorized access occurred between July 6-10, 2024, compromising personal data including Social Security numbers, dates of birth, and contact information
• The breach was part of a broader campaign targeting financial firms using low-tech phone calls and fake websites designed to steal employee passwords
• No evidence has been found that stolen information has been publicly posted or used for fraud; affected individuals are being offered complimentary identity protection services

Apollo Global Suffers Data Breach in Targeted Cyberattack on Financial Firms

Key Incident Details:

Apollo Global Management disclosed a data breach occurring between July 6-10, in which hackers gained unauthorized access to certain cloud platforms. The New York-based asset manager was among dozens of prominent U.S. financial institutions recently targeted by ransom-seeking cybercriminals.

Compromised Information:

The breach exposed personal information including names, dates of birth, contact details, home addresses, and social security numbers. Apollo notified law enforcement and engaged external cybersecurity and forensic experts to investigate the incident.

Attack Methodology:

Hackers employed low-tech tactics, primarily phone calls, to compromise victims—a method that remains highly effective despite sophisticated security programs and AI-driven defenses. Internet intelligence data revealed that cybercriminals created fake websites designed to steal employee passwords from private equity firms and financial companies.

Current Status:

Apollo's investigation is ongoing, with no evidence found that stolen information has been publicly posted or used for identity theft or fraud. The firm is offering affected individuals complimentary third-party identity protection and credit monitoring services through Head of Human Capital Matthew Breitfelder.

Broader Impact:

This attack is part of a wider campaign targeting hundreds of companies, including Uber and Levi Strauss. Multiple financial institutions have recently reported similar cybersecurity incidents involving unauthorized system access.

Market Implications:

The breach highlights ongoing cybersecurity vulnerabilities in the financial sector, particularly regarding social engineering attacks. Asset managers and financial institutions may face increased regulatory scrutiny and need to enhance security protocols, potentially impacting operational costs and client confidence.