← News
/DISPATCH · 2026-08-22

Apollo Global Management ($700B AUM) Confirms UNC6671 Social-Engineering Breach: SSN/DOB/Address Exposed; Another Hit in the Financial-Services Cluster

Apollo Global Management disclosed on 21 August that attackers socially engineered access to its cloud platform between 6–10 July. Some individuals' SSNs, dates of birth, home addresses, and contact data may have been obtained. TTPs align with the Google-tracked UNC6671 IT-Helpdesk impersonation cluster.

On 21 August 2026, Apollo Global Management (AUM over $700 billion) filed a data-breach notice with the California Attorney General confirming unauthorized access to its cloud platform between 6 July and 10 July. Attackers used social engineering to obtain access to internal cloud resources. Potentially affected data includes names, dates of birth, contact information, home addresses, and Social Security numbers (SSN). Earlier the same month, Google Threat Intelligence Group (GTIG) issued an industry warning on coordinated UNC6671 attacks against multiple Wall Street private-equity, hedge-fund, and insurance firms. Apollo's notice matches that cluster's TTPs.

Incident Overview

Per the 21 August notice signed by Apollo HR head Matthew Breitfelder, attackers used social engineering to bypass IT helpdesk process and obtain cloud access during a five-day window, 6–10 July. On 12 August internal investigation confirmed identity-sensitive fields may have been affected; public disclosure on the 21st. Apollo stated it notified law enforcement, retained an external forensics team, hardened access-control policy, and is offering affected individuals 24 months of TransUnion Cyberscout credit monitoring. California law requires a sample notice to the AG when more than 500 California residents are affected; the notice therefore implies >500 people. Apollo did not publish an exact count.

Technical Details (Attack Chain)

UNC6671 (tooling and infrastructure overlap with publicly reported Scattered Spider / ShinyHunters / Lapsus$ crews) typical path:

GTIG also disclosed UNC6293, UNC7005, and UNC5976—three suspected Russia-linked crews using the same playbook (Helpdesk impersonation + OAuth / device-code phishing). The Apollo incident maps more tightly to the UNC6671 financial-target cluster. GTIG noted a single cryptocurrency wallet had accumulated ~$10 million in ransoms in the first months of 2026, with individual ransoms ranging $750k–$3M.

Impact Assessment

Apollo AUM covers pensions, sovereign funds, family offices, and other ultra-high-net-worth client lists. Leaked PII can be reused for:

Apollo's public statement: no evidence that affected data has been posted publicly or used for identity theft and fraud. That does not rule out private circulation on dark-web/Telegram channels.

Fix and Mitigation

For affected individuals (current/former employees, investors, portfolio-company staff):

For enterprise IT/security teams (especially PE, hedge funds, insurance, consulting peers):

Industry Impact

This incident is a flagship landing of the UNC6671 Wall Street cluster Google disclosed on 6 August. Blackstone, Bridgewater, Bain, KKR, Moodys are listed as possible further targets. Financial institutions beyond Apollo should assume UNC6671 is already in the wild against them and immediately run lateral checks on Helpdesk reverse-confirmation, refresh-token governance, and JIT privilege.

References