Apollo's California filing puts Social Security numbers into the private equity attack wave

The number the filing does not contain is a detection date. Apollo puts the unauthorized access to its cloud platforms between July 6 and July 10 ^[2], and says it worked out on August 12 which categories of personal data had been taken ^[5]. That is 33 days from the last day of access to the determination ^[1], but Apollo did not say when or how it became aware of the intrusion, and it did not respond to a request for comment ^[3]. So the 33 days could be forensic reconstruction after a same-week catch, or most of a month of quiet before anyone looked.

Who signed the notice is also informative. It went out under the name of Matthew Breitfelder, Apollo's global head of human capital, and describes law enforcement notification, outside forensic experts, tightened protocols and an investigation ^[6]. Apollo has not said whose records these are, or how many people are involved ^[7]. A human capital byline on a notice listing dates of birth and Social Security numbers points toward people on a payroll rather than fund investors, though the company does not say that either.

Google's attribution supplies the name Apollo left out: BlackFile, affiliated with The Com, which recently split its extortion operations into four brands running on shared infrastructure, Redact, Pink, Helix and Falcon ^[8]. The method underneath the branding is a phone call. The group impersonates IT support in voice-phishing operations and moves from one sector to the next ^[11], having already worked through healthcare, technology, transportation, logistics, wholesale, and retail and hospitality this year ^[10]. That sequence is better read as a list of industries whose help desks will act on a convincing caller than as a ranking of whose data is worth having. Private equity, law firms, rating agencies and medical technology companies were the current stop ^[4].

Home addresses were in Apollo's compromised set ^[5], and Google has said some of this group's recent victims received threatening messages and faced escalation including swatting, a tactic used across several subsets of The Com ^[13]. That pairing is not what a credit monitoring enrolment is designed to answer, and it is the part of the filing that has a shelf life longer than the investigation.