Summary
- Environment: Certain Apollo cloud platforms
- Operational impact: Unauthorized access; potential personal-information exposure
- Financial impact: No incident cost established in the reviewed evidence
- Record status: Developing record. Reviewed October 28, 2026; updated as evidence emerges.
What happened
Apollo described a social-engineering incident involving unauthorized access to certain cloud platforms from July 6 through July 10, 2026. Its August 21 notification letter appears in a later California filing under Apollo Management Holdings, L.P. The later filing does not establish a new intrusion. [1][2]
Impact
Apollo determined on August 12 that potentially affected information included names and other recipient-specific fields. Those fields are redacted in the public template; their contents and the total affected population remain unknown. The letter reported no evidence of public posting, identity theft or fraud as of its August date. [2]
Timeline
Access window begins
The reported cloud-platform access window begins.
[2]Access window ends
The notice ends the access window on this date.
[2]Potential information impact identified
Apollo identified potentially affected personal information.
[2]Notification letter dated
The reviewed template carries this date.
[2]Briefing updated
This briefing was last reviewed and updated on October 28, 2026.
Threat Group & Attack Vector
Apollo identifies social engineering without naming the channel, cloud provider or attacker. The notice does not confirm data exfiltration. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Apollo notified law enforcement, engaged forensic specialists, enhanced controls and offered 24 months of credit monitoring and identity protection. Investigation continued at the letter date. [2]