Cqcrm Listed by Icarus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 22, 2026, the ransomware group Icarus listed Cqcrm on its leak site, stating that Salesforce data belonging to the organization had been taken in compressed form. The number of people whose records may be involved is not known, and no official statement from Cqcrm has confirmed or expanded on the listing. The practical implication is that any customer, partner, or employee data stored in the affected Salesforce environment could now circulate beyond the organization’s control. Until more details are released, those connected to Cqcrm have limited information on which to base their own protective steps.

Inside the incident

The only public record of the event is the group’s leak-site listing. It describes the removal of internal files during a ransomware attack, with the stolen material identified as Salesforce data in compressed format. No information has been released about when the intrusion began, how access was obtained, whether systems were encrypted, or whether a ransom was demanded.

Because the listing originates solely from the threat actor, the accuracy and completeness of the claim remain unverified by independent sources. The scale of the data and the number of individuals potentially affected are both undisclosed.

Inside Icarus

Icarus is a ransomware group that follows the common pattern of exfiltrating data, encrypting systems, and then posting victim names on a public site when payment is not received. The group’s listings serve as pressure tactics and as a record of claimed operations.

In the Cqcrm case, the group claims to hold compressed Salesforce files. No additional statements from Icarus about the contents or the circumstances of the theft have been made public beyond the basic listing.

About Cqcrm

Cqcrm is an organization that maintains customer and business records through Salesforce. Entities of this type typically store contact information, communication histories, account details, and related operational data to support sales and service functions.

Compromise of such a repository can expose both the organization’s internal processes and the personal or commercial information of the people and companies it serves. The reliance on cloud-based customer-relationship platforms makes the security of those environments a central concern for the sector.

The information in question

The reported material consists of internal files described as Salesforce data in compressed form. No further breakdown of file types or specific data fields has been provided.

Organizations that use Salesforce commonly hold names, email addresses, telephone numbers, and records of business interactions. Whether any of these elements are present in the exfiltrated material has not been confirmed.

Why it matters

Individuals whose details appear in the affected data may face increased risk of phishing or account-takeover attempts that leverage the exposed information. Organizations face the task of assessing the scope of the loss and strengthening controls around cloud-application access.

Because the volume and precise nature of the data remain unknown, the full range of downstream consequences cannot be measured at present. Both the organization and any connected parties must operate with incomplete information until further disclosures occur.

Were you affected?

Anyone who has interacted with Cqcrm should watch for unusual login attempts or unsolicited messages that reference their relationship with the organization. Enabling multi-factor authentication and reviewing account activity on any linked services are immediate, practical measures.

Readers can also submit their email address to a free exposure scan that checks against known breach datasets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.