Apollo's breach letter dates its own delay: four days in, 46 days out

Thirty-three days separate the last day of access from the day Apollo could say which fields were in it ^[1]. Nine more separate that from the letter going out ^[2]. End to end, from the first day of unauthorised access to the date on the notice, is 46 days ^[3], roughly eleven times the length of the intrusion itself ^[4].

That ratio is the useful thing here. Detection and containment are the intervals most incident programmes report to a board. The interval Apollo has documented is different: the stretch during which a firm knows something happened and still cannot tell anyone whose Social Security number moved. Nobody can be notified during it, and no regulator's clock starts until it ends.

The letter gives no detection date. The dates it supplies are the 6 to 10 July access window, the 12 August scope finding, and its own 21 August dispatch ^[21], which means the 33 days cannot be split between finding the access and understanding it. "Upon detecting the incident, we promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced our security protocols, and launched an investigation," wrote Matthew Breitfelder, Apollo's global head of human capital ^[6]. Promptly, measured from a day the letter does not give.

What Apollo filed in California is the blank mail-merge master, file name L01 Template_CA.pdf, with the name field reading "Dear :" ^[14]. So there is no recipient count, and no statement of whether the people receiving it are Apollo staff, employees of companies Apollo owns, or investors ^[8]. A letter signed by the head of human capital points at an employee population without saying so.

The remedy has its own asymmetry. Credit monitoring runs 24 months from enrolment, with 90 days to enrol ^[11], while the help line runs 90 days, weekdays, 8am to 8pm Eastern ^[12]. The phone support therefore expires about 21 months before the monitoring it exists to support ^[5]. The exposed categories stop at identity data with no bank or card details among them ^[10], which is the combination that stays usable long after two years. Enrolment also needs an internet connection and an email account, and the letter says it may not be available to minors under 18 ^[12]. The monitoring is provided by Cyberscout, described in the letter as a TransUnion company, while the same letter tells recipients to contact the three credit bureaus, TransUnion included ^[13].

On who did it, the letter says nothing beyond calling it a social engineering incident, similar to other financial services firms ^[5], and Apollo has not attributed it ^[18]. Google warned in July that a group it tracks as UNC6671, or BlackFile, was targeting private equity and financial firms, and Reuters reported Apollo among the companies targeted alongside Blackstone, Bridgewater and Bain Capital, without establishing that any attack succeeded ^[17]. Google describes the method as phone calls in which the caller poses as a colleague or IT support, then steers the target to a spoofed login page that harvests passwords and multi-factor codes, and puts some ransom payments at $750,000 ^[19]. Apollo declined to comment to Bloomberg, and a spokesperson did not answer TechCrunch's questions, including whether a ransom was paid ^[9]. Levi Strauss said the same month that social engineers compromised three employees' company-issued computers and took corporate data ^[20].

The control that failed was a person on a phone, and the number a board can actually govern is how long it takes to name the fields afterwards.