Private equity firm Apollo confirms data breach amid hacking wave targeting financial giants

Private equity giant Apollo Global Management has confirmed a data breach in which hackers stole reams of personal information from the company’s cloud systems. 

The breach comes a month after security researchers sounded the alarm on a new hacking campaign targeting financial and private equity giants.

The financial giant confirmed the incident in a letter filed with California’s attorney general. Apollo’s human resources chief Matthew Breitfelder said that hackers used a social engineering attack to gain access to the company’s cloud environment between July 6 and July 10. The hackers took names, birth dates, contact information, including home addresses, and Social Security numbers.

The letter does not specifically say who had their personal information stolen, such as Apollo employees or individuals at companies it owns. Apollo is one of the world’s largest private equity firms with $938 billion in assets under its management.

When reached by TechCrunch, Apollo spokesperson Giovanna Falbo did not immediately provide comment or answer questions about the incident, including whether the company paid the hackers a ransom.

Apollo has around 5,000 employees as of February 2026, according to the company’s public regulatory filings.

The now-confirmed hack comes weeks after security researchers at Google warned that hackers were targeting private equity companies and financial giants as part of a widespread extortion campaign. Reuters reported that Apollo was one of the companies that hackers targeted, alongside Blackstone, Bridgewater, Bain Capital, and others, but that it was unclear if any of the companies had been successfully breached.

Google says the hackers, who go by various names — Falcon, Helix, Pink, and Redact — rely largely on social engineering attacks that involve calling employees and pretending to be IT helpdesks or support. The goal is to trick the employees into entering their passwords and multi-factor authentication codes in spoofed login portals, which allow the hackers to gain access to corporate networks.

After stealing data, the hackers then extort the companies into paying a ransom or threaten to publish the data on their leak site.

Some of the attacks netted the hackers ransoms as much as $750,000, according to Google.

Until 2025, TechCrunch was a subsidiary of Yahoo, an advertising tech company owned by Apollo.