Icarus Group Steals Salesforce Data via Klue OAuth Breach: Ransomware Claim — What’s Alleged & What To Do

On June 18, 2026, reports stated that the threat actor group Icarus had accessed Salesforce customer-relationship-management records belonging to the cybersecurity firm Huntress by exploiting an OAuth integration with the Klue Battlecards application. The number of people whose information was involved has not been disclosed. The incident forms part of a wider pattern of attacks that target trusted third-party connections to enterprise platforms rather than the platforms themselves.

What happened

According to the available information, Icarus obtained access to Huntress Salesforce data through a breach of OAuth credentials associated with the Klue Battlecards app. The same method is described as having affected multiple other organizations that use Salesforce. No figures have been released for the volume of records taken or the precise dates of the access and exfiltration.

The reported summary characterizes the activity as an ongoing supply-chain-style campaign against Salesforce integrations. No further technical details, such as the initial point of compromise or duration of access, have been made public.

The group behind it: Icarus

The incident is attributed to the group Icarus. The group’s involvement rests on its listing of the victim in connection with the data. Public reporting on Icarus has previously described operations that focus on data theft from corporate environments through compromised credentials and third-party services.

Any specific claims made by the group about the Huntress data appear only in the context of the current listing and remain unverified beyond that attribution.

Huntress and its sector

Huntress operates in the cybersecurity sector, providing managed detection and response services to smaller and mid-sized organizations. Firms in this sector routinely maintain records of client environments, security telemetry, and business relationships that support service delivery.

Compromise of such records can extend visibility into both the provider’s own operations and the customer base it supports.

What was likely exposed

The information described as taken consists of Salesforce data, business contacts, and sales records. Additional categories mentioned in reporting include sales communications, price quotes, and competitive intelligence material stored within the same system.

The exact scope of records and the number of individuals affected remain undisclosed. Organizations of this type commonly store the following categories of data:

• Customer and prospect contact details
• Sales pipeline and quote information
• Internal notes on competitive positioning

What's at stake

Exposure of business-contact and sales data can lead to increased targeted phishing, impersonation attempts, and competitive intelligence gathering by other parties. For the affected organization, the incident may prompt reviews of integration permissions and OAuth token management across connected applications.

Because the scale of the data set is unknown, the duration and intensity of any follow-on activity cannot yet be assessed.

Were you affected?

Individuals can begin by monitoring their email accounts and professional contact points for unusual messages that reference recent business interactions. Organizations should review connected applications within their Salesforce instances and revoke unused OAuth authorizations.

Readers may run a free exposure scan of their email address against known breach data sets to determine whether their information appears in publicly referenced incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.