Apollo Confirms Social-Engineering Breach Exposing Personal Data
Summary
Apollo says attackers accessed some cloud platforms July 6–10, compromising names, dates of birth, contact details, home addresses and Social Security numbers. Google attributed the broader campaign to BlackFile; Apollo found no evidence data was posted or misused.
Key points
- Apollo confirmed attackers used social engineering to gain unauthorized access to some of its cloud platforms from July 6 to July 10.
- Apollo determined on Aug. 12 that names, dates of birth, contact information, home addresses and Social Security numbers were compromised; it did not disclose how many people were affected.
- Apollo said it had found no evidence that the data was posted online or used for identity theft or fraud.
- Apollo said it notified law enforcement, engaged outside cybersecurity and forensic experts, enhanced security protocols and launched an investigation.
- Apollo did not identify the attackers. Google attributed the broader campaign to BlackFile, which it linked to The Com and the extortion brands Redact, Pink, Helix and Falcon.
- The reported campaign uses voice phishing and impersonation of IT support; Google researchers have also described threats and escalation tactics, including swatting.
- Researchers said Blackstone and Bain Capital were targeted with malicious infrastructure, but it remains unclear whether those firms were compromised.
Article Details
- Victim Organization
- Apollo Global Management
- Incident Type
- Social engineering attack resulting in unauthorized access to cloud platforms and exposure of personal data
- Data Types Exposed
- Names
- Dates of birth
- Contact information
- Home addresses
- Social Security numbers
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Attackers accessed some of Apollo's cloud platforms between July 6 and July 10. Apollo determined on Aug. 12 that personal data had been compromised. Apollo reported no evidence that the data had been posted online or used for identity theft or fraud.
- Ransom Or Extortion
- No Apollo-specific extortion demand is reported. The broader group is reported to threaten alleged victims with extortion demands.
- Claim Status
- confirmed
MITRE ATT&CK
People
Threat Actors
BlackFileGoogle attributed the broader campaign to BlackFile. Apollo did not name the group as responsible for its breach.FalconNamed as one of the four brands across which BlackFile reportedly split its extortion operations; the brands are described as sharing infrastructure.HelixNamed as one of the four brands across which BlackFile reportedly split its extortion operations; the brands are described as sharing infrastructure.PinkNamed as one of the four brands across which BlackFile reportedly split its extortion operations; the brands are described as sharing infrastructure.RedactNamed as one of the four brands across which BlackFile reportedly split its extortion operations; the brands are described as sharing infrastructure.The ComDescribed as affiliated with BlackFile and as having subsets associated with escalation tactics including swatting.
Industries
Financial rating agenciescare was compromised by a wave of attacks that have hit large private equity firms, law firms, financial rating agencies and medical technology companies.HealthcareBlackFile and its various affiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of thisHospitalityindustries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.lawdata under its care was compromised by a wave of attacks that have hit large private equity firms, law firms, financial rating agencies and medical technology companies.logisticshave impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.medical technologywave of attacks that have hit large private equity firms, law firms, financial rating agencies and medical technology companies.Private equityAttackers gained unauthorized access to some of the private equity firm’s cloud platforms between July 6 and July 10, the company said in a data breach notification filed in California.Retailin multiple industries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.Technologyof attacks that have hit large private equity firms, law firms, financial rating agencies and medical technology companies.Transportationaffiliates have impacted organizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.Wholesaleorganizations in multiple industries, including healthcare, technology, transportation, logistics, wholesale, and retail and hospitality since the beginning of this year.