Apollo Global Management·Financial services·
Personal information was stolen.
Apollo confirmed a social-engineering breach involving cloud access and exposure of names, addresses, birth dates, and Social Security numbers. The exact technical root cause is not established in the attached record.
Report freshness and timeline
- First publicly reported
- First disclosed
- Latest attached source
- Radar data checked
Coverage window — Dataset generated Aug 30, 2026, 12:03 UTC
Executive incident brief
- Incident confirmation
- Organization confirmed
- Mechanism
- Entry path: Phishing Social Engineering
- Consequence
- Reported: Personal information was stolen.
- Scope
- The complete extent is not established by this record.
1)Incident fact sheet
- Organization
- Apollo Global Management
- Industry
- Financial services
- Disclosed
- Entry path
- Phishing Social Engineering
- Affected asset
- cloud environment
- Country
- US
- Data involved
- Personal data
- Reported impact
- Data exposure
- Attached evidence
- 5 independent domains · 5 sources
2)Evidence-backed incident path
- 01
Entry path
Initial access involved phishing social engineering.
ConfidenceSecondaryExact excerpt
E1“hackers used a social engineering attack to gain access to the company’s cloud environment”
techcrunch.com · Aug 21 - 02
Reached
cloud environment
ConfidenceSecondaryExact excerpt
E2“access to the company’s cloud environment”
techcrunch.com · Aug 21 - 03
Observed
Personal information was stolen.
ConfidenceProbableExact excerpt
E3“hackers stole reams of personal information”
techcrunch.com · Aug 21
3)Impact and scope ledger
Established
Supported at the stated evidence level.
Reported
Present in public reporting; not independently established by Radar.
Not publicly established
No qualifying public evidence in the attached record.
- The exact technical root cause
- Whether a regulatory fine followed
- That a Defence review would have prevented this incident
4)Relevance to your product
One durable credential can carry yesterday's access into today's product.
This pattern applies when…
- Products that use cloud identity accounts to access personal records.
Diagnostic questions
- Can a credential retain access beyond its intended lifetime or role?
- Are sessions isolated across users, tenants and recovery paths?
- Can tokens be rotated or revoked without leaving a parallel route open?
This incident does not establish your product's risk.
5)Sector context — Financial services
- 2 incident threads
- 0 incident threads
- 1 incident threads
- 4 incident threads
- 7 incident threads
- 10 incident threads
- 4 incident threads
- 10 incident threads
- 7 incident threads
- 7 incident threads
- 5 incident threads
- 8 incident threads
- Same incident family
- 11 Credential / identity compromise
- Confirmed share
- 23% 15 confirmed · 50 reported
- Display family
- Credentials Used for Radar's public chart taxonomy
Publicly disclosed incidents and reports from to . Historical discovery is partial and does not measure breach probability.
Explore Financial services in Radar →6)Defence control mapping
What Defence can test
Identity and session testing
- Can a credential retain access beyond its intended lifetime or role?
- Are sessions isolated across users, tenants and recovery paths?
- Can tokens be rotated or revoked without leaving a parallel route open?
Also relevant: Configuration and exposure review
What cannot be concluded
- This incident does not predict an individual product's risk.
- A mapped control does not establish that a Defence review would have prevented the event.
7)Public evidence ledger
5 attached sources across 5 independent domains. No attached source is marked as an organization or regulator primary source.
Does this access boundary exist in your product?
A bounded review can test the authorized web/API path without assuming this incident predicts your risk.