Loading story…
Apollo Global Management disclosed a data breach after attackers gained unauthorized access to certain cloud platforms and stole personal information from its systems. The firm said the intrusion occurred between July 6 and July 10 and exposed data including names, dates of birth, contact details, home addresses, and Social Security numbers, according to its filing with the California attorney general.
The breach appears linked to a broader extortion campaign targeting major U.S. financial institutions and private equity firms. Reporting tied the activity to social engineering tactics including fake IT helpdesk calls, spoofed login portals, and theft of passwords and multi-factor authentication codes. Apollo said it has notified law enforcement, engaged outside cybersecurity and forensic specialists, and is offering affected individuals identity protection and credit monitoring while the investigation continues.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Apollo said it determined on Aug. 12 that the intrusion had compromised personal data, including names, dates of birth, contact information, home addresses, and Social Security numbers. This provided a specific date for when the company confirmed the scope of exposed information.
Apollo said it learned earlier in August that the potentially impacted information included names, dates of birth, contact information, home addresses, and Social Security numbers. This clarified the scope of the data exposed in the intrusion.
Apollo Global Management said attackers gained unauthorized access to certain cloud platforms between July 6 and July 10 using a social engineering attack. The attackers stole personal information including names, dates of birth, contact information, home addresses, and Social Security numbers.
Apollo said affected individuals would receive complimentary third-party identity protection and credit monitoring services. The company also said it had not found evidence at the time of reporting that the stolen data had been publicly posted or used for fraud.
Apollo confirmed the data breach in a letter filed with the California attorney general. The disclosure said attackers used social engineering to access Apollo's cloud environment and steal personal information.
Following the breach, Apollo notified law enforcement and engaged outside cybersecurity and forensic experts to investigate. The company said its investigation remained ongoing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcesecuritymagazine.com
Open sourcemalware.news
Open sourcesecurityweek.com
Open sourcecyberscoop.com
Open sourcebusinessinsurance.com
Open sourcetechcrunch.com
Open sourceteiss.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected. Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
Sep 26, 2026
ApolloMD, a US-based healthcare services and practice management provider and HIPAA business associate, disclosed that a May 2025 cyberattack led to unauthorized access to its IT environment and potential theft of patient data affecting **626,540** individuals. ApolloMD reported detecting unusual activity on **May 22, 2025**, and its investigation concluded an unauthorized party accessed systems between **May 22–23, 2025**, including files tied to patients treated by affiliated physicians and practices; the incident was later reflected in US HHS breach reporting. Exposed data varied by individual but included **names, dates of birth, addresses, diagnoses, treatment details/dates of service, provider names, health insurance information**, and for some, **Social Security numbers**. Reporting also linked the incident to the **Qilin ransomware** group, which publicly listed ApolloMD on its leak site in June 2025 and claimed exfiltration of **238 GB** (posting limited proof screenshots not showing patient data); ApolloMD’s public notice did not confirm ransomware, encryption, or a ransom demand. ApolloMD notified affected client practices between **July–September 2025**, issued patient letters in mid-September 2025, and posted a substitute notice later that month, including a list of impacted managed physician practices.
Jun 29, 2026
**Betterment** disclosed that a **social engineering** attack against a **third-party platform account** used for customer communications enabled unauthorized access to internal systems in early January, leading to the exposure of personal data tied to **1,435,174 accounts**. The intruder used the access to send **fraudulent crypto-themed promotional messages** impersonating Betterment and promising to “triple” cryptocurrency sent to attacker-controlled wallets (including **Bitcoin and Ethereum** addresses). Betterment said it revoked the unauthorized access the same day it was detected, warned customers to ignore the messages, and initiated a forensic investigation with external incident-response support. Breach analysis and indexing by **Have I Been Pwned** indicated the exposed dataset included **email addresses, names, and location data**, with reporting also citing additional PII such as **dates of birth, physical addresses, phone numbers, device information, and employment-related details**. Betterment stated there is **no evidence** that customer investment accounts were accessed or that **passwords/authentication tokens** were compromised, characterizing the incident as an exposure of contact/identity data rather than account credentials. Separate reporting noted Betterment also experienced **intermittent outages attributed to a DDoS attack and extortion attempts** around the same period, but this was described as distinct from the social-engineering-driven data exposure.
Jun 29, 2026