Short answer
Apollo, the private equity and credit firm, told people in letters dated 21 August 2026 that it suffered a social engineering incident. Unauthorized parties accessed certain cloud platforms between 6 and 10 July 2026, and on 12 August Apollo learned personal information was potentially affected. It has not said how many people are involved.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Apollo Management Holdings, L.P. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Financial services (alternative asset management) |
| Country | United States |
| Detected | 2026-07-06 |
| Disclosed | 2026-08-21 |
| People or records affected | Not stated by Apollo; Vermont's listing records 2 Vermont residents |
What data was exposed
- Names
- Dates of birth, contact information and home addresses (as reported by CyberScoop)
- Social Security numbers (as reported by CyberScoop); Vermont's listing also records government ID numbers
What happened
Apollo Management Holdings, L.P. is part of the Apollo private equity and credit group. In a sample notice posted by the California Attorney General, dated 21 August 2026, the firm says it “recently experienced a social engineering incident.” Its investigation determined there was unauthorized access to certain cloud platforms between 6 and 10 July 2026.
Apollo says it notified law enforcement, engaged outside cybersecurity and forensic experts, strengthened its security protocols and opened an investigation. It learned on 12 August that personal information was potentially affected, and it says the investigation remains ongoing, so more updates may follow.
What data was involved
The letter lists your name and then a variable line that differs by recipient. CyberScoop reported on 21 August that the categories include names, dates of birth, contact information, home addresses and Social Security numbers. The Vermont Attorney General’s listing records a notice dated 21 August with 2 Vermont residents, and lists Social Security numbers and government ID numbers as the data types.
Apollo did not say how many people are affected, whether they are employees, employees of portfolio companies or investors, or which cloud platforms were reached.
Who was behind it
Apollo has not attributed the incident. CyberScoop reports that Google tracks a group called BlackFile that impersonates IT support in voice phishing and other social engineering attacks against firms in finance and other sectors, and that Apollo was the first in the sector to formally disclose sensitive personal data being compromised in that wave. That is context about the campaign, not a confirmed link to Apollo’s incident.
What Apollo is offering
Apollo is providing credit monitoring and identity protection through Cyberscout, a TransUnion company, with alerts for 24 months from enrollment and proactive fraud assistance. Recipients must enroll within 90 days of the letter date, and the help line is staffed Monday to Friday, 8 a.m. to 8 p.m. Eastern for the same 90 days.
What is still unknown
- how many people received letters;
- how the attackers gained access and which platforms they reached;
- whether anyone has made demands or published data.
Staying safe
A stolen Social Security number and date of birth are enough to attempt identity fraud, and callers who pose as IT or fraud staff are the pattern behind this campaign. Our guide to vishing and callback phone scams explains how to verify a caller, what to do after a data breach covers freezes and monitoring, and phishing messages shows how to spot a fake enrollment link.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phone calls from someone claiming to be IT support, a fraud team or Apollo itself, asking you to verify identity details or install software
- Fake credit-monitoring emails or texts that copy the Cyberscout offer and send you to a look-alike sign-up page
- Identity-theft attempts that use a Social Security number and date of birth to open accounts or file false tax returns
- Extortion-style messages threatening to publish your details
What to do if you are affected
- 01If you got a letter from Apollo (sent through Cyberscout, a TransUnion company), enroll in the 24 months of credit monitoring using the code in the letter. You have 90 days from the letter date.
- 02Do not give your Social Security number or account logins to anyone who calls or messages you about this incident. Apollo's letter points you to a help line printed on the letter.
- 03Consider a free fraud alert or credit freeze with Equifax, Experian and TransUnion, and review your free credit reports.
- 04Review financial statements for activity you do not recognize, and report anything to the institution straight away.
- 05Hang up on unexpected calls from 'IT' or 'security' staff and call back using a number you already know.
Frequently asked questions
What did Apollo say happened?
Its letter says the firm experienced a social engineering incident and that there was unauthorized access to certain cloud platforms between 6 and 10 July 2026. It learned on 12 August that personal information was potentially affected.
What information was involved?
The letter's data line is variable text that begins with your name. CyberScoop reported the categories as names, dates of birth, contact information, home addresses and Social Security numbers.
Who was affected?
Apollo has not said whether the people are employees, portfolio company staff or others, and has not given a total. Vermont's listing records 2 Vermont residents.
Has anyone claimed the attack?
Apollo has not named an attacker. CyberScoop reports Google attributes a wider wave of social engineering attacks on financial firms to a group called BlackFile, but that report does not say Apollo's incident was confirmed as part of it.
Is my data online?
Apollo says it has no evidence the information has been publicly posted or used for identity theft or fraud, and that its investigation is ongoing.
Sources
- Apollo notice of data breach (sample letter dated 21 August 2026), California Attorney General (organization notice), 2026-08-21
- Apollo discloses data breach from social engineering attack, CyberScoop, 2026-08-21
- Security breach notices, Apollo Management Holdings, L.P. (8-21-2026), Vermont Attorney General, 2026-08-21
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.