Cybercrime Breaches Klue: Salesforce Data Impacted for Many Victims, including Huntress

What it is

Huntress's running incident log on the Klue breach (updates dated 6/19–6/24/26), in which threat actor Icarus exfiltrated Salesforce CRM data from Klue's downstream customers, including Huntress. Beyond the summary's account, the page tracks an escalation the summary predates: a second, separate unauthorized party now claiming access to Klue-related data.

Preconditions / Affected

You matter here if your organization is a Klue customer or was named in Icarus's leak. Nearly 200 companies are reportedly on the new party's list. Impacted data (per Huntress's own case) is Salesforce-scoped: business contact info (names, work emails, titles, phone, business addresses), business names, products trialed/used, subscription/pricing details, sales communications (quotes, tasks, contacts), and free-form opportunity notes. Huntress states no product, infrastructure, telemetry, password, or payment-card data was impacted.

How it works

The extortion is now two-pronged. Icarus published named victim data on its leak site (hosted on AS200593 / PROSPERO OOO, a Russia-registered ASN carrying a Censys BULLETPROOF designation) on June 22 and is pressuring victims to pay to prevent release. Separately, on June 24 an unverified party claimed it will publish sample data on the ~200 companies that engaged with Icarus, then release victim information daily unless a "compromise" is made — a distinct pressure campaign layered on top of the original breach.

flowchart TD
    K[Klue Salesforce breach] --> I[Icarus: leaks named victims 6/22, ransom pressure]
    K --> S[Second party 6/24: claims access]
    S --> T["Threatens ~200 companies<br/>daily releases unless 'compromise'"]
    T -.unverified.-> V[Under investigation]

What to do

The page's concrete guidance for potentially-impacted organizations:

• Do not dig through the raw leaked dataset. Leak archives are "often laced with malware." Confirm your inclusion through your incident response team, legal counsel, and a trusted intel partner instead.
• Treat any ransom negotiation with skepticism — Huntress notes cybercriminals shouldn't be trusted to honor a deal.
• Watch for sales-specific phishing in coming weeks: attackers may impersonate Huntress or other Klue customers using the stolen CRM data. Verify via known, trusted channels.

Caveats

The 6/24 claims — the second party, the ~200-company list, the daily-release threat — are explicitly unverified and under active investigation "in coordination with security researchers." Huntress's "no product/telemetry/credential impact" finding is qualified as "based on current evidence." Note also that misleading filenames appear in the dump (e.g., stripeGC_Stripe_Account_c.json contained only metadata, not payment data), so a scary filename in the leak does not by itself indicate sensitive exposure.