$1T investment giant Apollo breached after social engineering attack
- ID
- 17192
- Status
- summarized
- Published
- 24 Aug 2026, 7:29 PM
- Fetched
- 24 Aug 2026, 7:48 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/24/1t-investment-giant-apollo-breached-after-social-engineering-attack/5291609
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 4.5
- Created
- 24 Aug 2026, 7:49 PM
- Tags
- Audience
- developerssaas_founders
What happened
Apollo Global Management ($1T AUM) disclosed that attackers used social engineering to access its cloud platforms between July 6-10, exposing names, DOBs, addresses, and Social Security numbers. The breach is linked to a broader campaign by UNC6671/BlackFile, which targets private equity firms by calling employees on personal phones while posing as colleagues or IT support, then directing them to spoofed login pages to harvest credentials and MFA codes.
Why it matters
If you build or administer cloud-based systems, this confirms that MFA alone doesn't stop credential phishing via real-time social engineering — attackers are calling staff on personal phones and walking them to fake login pages. Consider phishing-resistant auth (FIDO2/passkeys) and training staff to verify out-of-band any login prompt initiated by a phone call, especially if your org handles sensitive PII or financial data.
Discussion angle
The attack chain here — personal phone call → spoofed login page → harvested credentials + MFA codes → four days inside cloud platforms — is a playbook any SaaS team should rehearse defending against; discuss whether your current auth stack would survive this specific vector.