C* Listed by Icarus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
C* has been listed by the Icarus ransomware group, with internal files reported as exfiltrated in an attack. The listing came to light on June 23, 2026, and an undisclosed number of people may be affected; individuals should check whether their information was involved and take appropriate steps.
On June 23, 2026, the ransomware group Icarus listed C* on its leak site, claiming to have exfiltrated internal files during a ransomware attack that included Salesforce data belonging to the company. The number of individuals affected remains unknown, and no further details on the volume or specific contents of the data have been made public.
What happened
The incident centers on a listing posted by Icarus that identifies C* as a victim. The group states that internal files were taken, with the material described as Salesforce data for the corporation and noted only by its compressed size. No confirmation of the listing’s accuracy, the method of access, or the timeline of the intrusion has been released by C* or independent investigators. The scale of the operation and any ransom demand or payment status are not disclosed in available information.
Inside Icarus
Icarus is a ransomware operation that follows the common pattern of encrypting systems, removing copies of data, and posting victim names on a public leak site when negotiations fail or to apply pressure. Such groups typically maintain infrastructure for data storage and often re-use established intrusion techniques across multiple targets. Public records show Icarus has appeared in prior listings involving corporate environments, though each claim requires separate verification.
Who is C*?
C* is a corporation that maintains customer and operational records in Salesforce. Organizations of this type routinely store contact details, transaction histories, account configurations, and internal process documentation within the platform. A breach involving such data can expose structured business information that is not normally available outside the company’s controlled systems.
What was likely exposed
The only confirmed description from the listing is that internal files, characterized as Salesforce data, were removed. The exact fields, record counts, or file categories have not been published. Companies that use Salesforce commonly hold customer names, email addresses, purchase records, support tickets, and configuration details; however, whether any of these categories are present in the exfiltrated material remains unconfirmed.
Why it matters
Exposure of Salesforce records can reveal patterns of business relationships and internal workflows that are otherwise kept private. Individuals whose information appears in those records may face increased risk of targeted phishing or account misuse if the data later circulates. For the organization, the incident adds the cost of investigation, potential regulatory reporting, and the need to review access controls around its cloud applications.
Were you affected?
Individuals can begin by monitoring their email accounts for unexpected messages that reference C* or Salesforce. Running a free exposure scan against known breach repositories provides one way to check whether an email address has appeared in previously published data sets. Organizations and customers should also watch official statements from C* for any further details on the scope of the incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
H* Listed by Icarus Ransomware GroupG* Listed by Icarus Ransomware GroupHDS (Hdscorp) Listed by Icarus Ransomware GroupCqcrm Listed by Icarus Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the C* Listed by Icarus Ransomware Group →
Publicly posted by icarus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.