The Apollo Global Management breach: Social Security numbers, and no count

Between 6 and 10 July 2026, someone got into cloud systems belonging to Apollo Global Management, one of the largest alternative asset managers in the world. The way in was not a software flaw. According to the company’s own account, employees were talked into entering their credentials and one-time codes on convincing fake sign-in pages, the same phone-and-webpage routine that has been working against large companies all year. Apollo says its investigation established on 12 August that personal data had actually been involved, and notification letters went out from Friday 21 August. The filing with the California attorney general, and the reporting that followed on 21 to 24 August, are where everything public about this comes from. Apollo has published no separate statement of its own beyond the notice.

Apollo is not a consumer service. Nobody has an Apollo account the way they have a bank or a shopping account, which is what makes this letter confusing to receive. The records a firm like this holds on individuals come from being an employer, a former employer, a recruiter, and an owner of other businesses: tax and payroll paperwork, onboarding and background files, and administrative records for people at the companies in its portfolio. Apollo has not said which of those groups the notifications went to, and reporters who asked did not get an answer. So the letter tells you your details were in a file that was taken, and not much about why they were there. That question is worth putting to the company in writing.

The notification lists names, dates of birth, contact information, home addresses and Social Security numbers. Apollo states that investment and financial account information was not involved. That is genuinely the better outcome for anyone with money there, but it does not make the rest harmless, because the fields that did come out are the permanent ones. You can change a password in a minute and a card number in a week. A Social Security number is issued once, a date of birth never moves, and together with a current address they are most of what a lender uses to satisfy itself that an application is really you. That is the exposure here, and it does not decay on its own.

Freeze your credit file at all three bureaus first: Equifax, Experian and TransUnion, each separately, online, for free. A freeze blocks a new account being opened in your name, which is the thing this particular data set enables. Then take the 24 months of monitoring in the letter, because it is paid for and catches what a freeze does not, but treat it as the second layer rather than the answer. Two more are worth the time if a Social Security number of yours is in circulation: request an Identity Protection PIN from the IRS, which stops someone filing a tax return in your name, and check your Social Security earnings record for employment you did not do. Keep the letter and the date it arrived. If anything comes of this later, that paperwork is what makes a claim or a complaint easy.

Every breach that reaches the news is followed within days by messages pretending to be the notification. This one has the ingredients that make them work: a household name, Social Security numbers in the headline, and a lot of people who cannot immediately tell whether they are affected. Apollo notified by post from 21 August. A genuine notice explains what happened and how to enrol in the monitoring it offers; it does not ask you to confirm your Social Security number, and it has no reason to need your bank details. Judge any message by how it reached you rather than by how it reads, because the wording and the logo are the easy part to copy. If you want to verify something, look the company up yourself instead of using a number or a link the message supplied. Our guide to breach notification letters goes through what a real one contains, line by line.

Within three days of the disclosure, law firms were publishing investigations into the breach and sites were collecting names of affected people. It is worth knowing what that stage is. A firm announcing an investigation is looking for clients; it is not a filed case, not a certified class, and certainly not money waiting to be claimed. If a case is filed and eventually settles, the notice comes from a court-appointed administrator, arrives by post, and claiming costs nothing. That is a process measured in years. Until then, treat any request for a fee or for your Social Security number in exchange for “registering your claim” as the scam it is. If you want to see what a real payout stage looks like, our list of settlements currently taking claims is checked against the official administrator sites.

A breach notice closes a file at the company and changes nothing about what is already published about you. The address and phone number that made the stolen record useful are sold openly by people-search and data-broker sites, and that is where the next set of target lists gets built no matter who is breached next. Getting those listings removed is the one step here whose effect lasts past the news cycle, and it needs repeating rather than doing once, because brokers rebuild profiles from public records within weeks. For the general version of the response, our post-breach guide covers it in seven steps.