G* Listed by Icarus Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
G* was listed by the Icarus Ransomware Group on June 23, 2026, after internal files were exfiltrated in a ransomware attack. An undisclosed number of people may have been affected; check the listing and your own accounts for any signs of exposure.
Breaking down the breach
The only confirmed public record is the June 23, 2026 listing by Icarus. The group states that it exfiltrated internal files in a ransomware attack and identifies the material as compressed Salesforce data. No independent confirmation of the data’s contents, the date of the intrusion, or the method of access has been made available. The number of people potentially affected is listed as unknown.
Inside Icarus
Icarus is a ransomware operation that maintains a public leak site where it lists organizations it claims to have targeted. Like other groups in this category, it typically combines encryption of systems with the threat of data publication. Its listings are presented as claims by the group itself and are not verified by third parties unless additional evidence surfaces.
Who is G*?
G* is a corporation that uses Salesforce for customer and operational records. Companies of this type routinely store contact details, transaction histories, and internal workflow data within such platforms. A compromise of these records can expose both business processes and information about individuals who interact with the organization.
What was likely exposed
The listing names compressed Salesforce data and internal files as the material taken. No further breakdown of file types or record categories has been published. While organizations that rely on Salesforce commonly hold customer account information, employee records, and business correspondence, the precise contents of the exfiltrated archive remain unconfirmed beyond the group’s description.
What's at stake
Exposure of Salesforce-related files can result in the disclosure of personal and commercial information that organizations normally keep restricted. Individuals may face follow-on risks such as targeted phishing or misuse of contact details. For the corporation, the incident adds to the operational burden of investigating the intrusion and managing any resulting regulatory or contractual obligations.
What to do if you're exposed
Individuals who believe their information may be involved should monitor accounts for unusual activity and consider enabling additional authentication steps where possible. Organizations typically advise affected parties to review statements from the company once an investigation concludes. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances in public records.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
C* Listed by Icarus Ransomware GroupH* Listed by Icarus Ransomware GroupHDS (Hdscorp) Listed by Icarus Ransomware GroupCqcrm Listed by Icarus Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the G* Listed by Icarus Ransomware Group →
Publicly posted by icarus — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.