Cazh.id Listed by Icarus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 5, 2026, the Icarus ransomware group listed Cazh.id on its leak site, claiming to have obtained internal files from the organisation. The number of individuals affected is not stated in public reporting, and the organisation has not confirmed the incident or the extent of any data access. The listing describes a ransomware operation in which files were taken, though independent verification of the claims has not been published. No details on the initial access method, encryption of systems, or ransom demands have been released.

Breaking down the breach

The reported date of the listing is May 5, 2026. Public information on the scale of the intrusion remains limited to the contents described in the listing itself. The group claims to have taken a user database associated with the subdomain bkdp.cazh.id containing records for 300,000 users, along with a separate KYC vault, 34 SQL databases linked to schools, corporate and financial records, collateral documents, billing proofs, and source code. No confirmation of these volumes or their current status has been issued by Cazh.id.

The group behind it: Icarus

Icarus is a ransomware operator that maintains a public leak site to list organisations it claims to have targeted. The group typically publicises stolen data after encryption or exfiltration attempts in order to pressure victims. Its listings are presented as claims by the group; independent confirmation of any specific incident is required before the contents can be treated as verified.

Cazh.id and its sector

Cazh.id operates services that include user registration, identity verification, and data handling for educational institutions. The presence of school-related databases and investor records indicates the organisation processes information across education and financial-adjacent functions. Breaches at entities holding both personal identifiers and verification documents can affect large numbers of individuals whose records are stored for compliance or service delivery.

What data was at risk

The listing names several categories of material. These include a user database with email addresses, password hashes, phone numbers, physical addresses, and dates of birth; a KYC vault containing government-issued IDs and selfies; school databases covering students, parents, and staff; investor and partner documents; vehicle registration records; property deeds; billing proofs; and application source code. The exact scope of any confirmed exposure has not been disclosed by the organisation, so the listed items remain claims rather than verified inventories.

The real-world impact

Exposure of government IDs, selfies, and address-linked records can facilitate identity fraud or account takeover attempts. Source code disclosure may assist further attempts to locate vulnerabilities in related systems. For the organisation, the incident creates operational and regulatory questions around data handling, though the concrete consequences depend on factors that have not yet been made public.

If your data was in this claimed breach

Individuals can begin by monitoring their financial and government accounts for unusual activity and by changing passwords on any services that reuse credentials listed in the claimed database. Enabling multi-factor authentication where available reduces the value of password hashes. A free exposure scan using an email address can show whether the address appears in previously published breach datasets, providing a starting point for further checks.

AICompiled with AI assistance from public sources and published under our editorial standards.