- Threat intelligence trackers report that software company Klue has been listed as a victim of the Icarus ransomware group.
- The claim comes days after reports tied Icarus to a breach involving Klue’s Salesforce-connected systems and customer data.
- While there’s no independent verification of the 1 GB data theft yet, security researchers believe attackers gained access to sensitive business information.
Software company Klue is facing new scrutiny after threat intelligence monitors reported that the firm had been added to the victim list of the Icarus ransomware group. The reports suggest that Icarus got hold of about 1 GB of Klue’s data.
The group has asked Klue to contact them to avoid fallouts for other companies they work with. They didn’t share much proof to back it up. But Klue has already released an update saying they’re investigating the incident.
The company didn’t mention the particular threat group behind the attack; it only stated that the breach affected Salesforce and a few other third-party platforms.
Breach Reports Emerged Earlier this Week
Klue, a company that offers competitive intelligence software, recently came up in reports about a larger cyberattack involving Salesforce customer systems. According to security researchers and incident response teams, attackers got into parts of Klue’s infrastructure without permission.
Once inside, they stole authentication tokens linked to customer accounts. With those tokens, the attackers could see and pull data from the affected Salesforce environments.
Reports indicated that information tied to sales operations, customer records, business communications, and other company data may have been exposed. As news of the incident spread, Salesforce reportedly suspended certain Klue integrations while investigations continued. Multiple researchers have attributed the incident to the threat group, Icarus.
Details of the Stolen Data
Currently, many key things about the breach are still not very clear. Although the latest report mentioned the stealing of 1 GB of data, there’s no independent confirmation of that specific amount of data. There has also not been any public disclosure or report of an actual breach dataset to confirm this breach.
Previous reports on the Klue breach have identified that the attackers likely secured access to customer account numbers, records related to sales activity, business contacts, competitive intelligence materials, and company internal communications.
The theft of sensitive business data mirrors what occurred in the Orisha incident, where a French software firm also saw multiple business solutions compromised in a cybersecurity breach.
However, the researchers who looked into it said there was no evidence that the breach compromised payment card information, customer passwords, or core engineering systems.
This distinction is meaningful, as it seems the intent of the attack is more about obtaining valuable business information. There were no apparent intentions to disrupt the organization’s operations.
The Nature of the Attack Still Unclear
Some reports have described the breach as a ransomware attack, but so far, the signs indicate it’s more of a data theft and extortion incident. Ransomware typically involves hackers encrypting a company’s files and demanding payment to restore access.
In this case, there’s no word that the attacker encrypted Klue’s systems, no ransom note, and no reports that anyone locked the company’s files or their business ground to a halt.
What’s actually out there suggests the attackers were after information. They grabbed data and tried to use it as leverage to extort people, which is something a lot of cybercriminals do now. Instead of bothering with file encryption, they threaten to leak sensitive info unless the victims pay up.
Who is Icarus?
Icarus is pretty much a new player in the cybercrime world, and people first started taking notice of the group this year. The group has conducted data theft campaigns and extortion attacks targeting businesses. Security researchers recently linked Icarus to attacks targeting Salesforce-connected environments, which makes the Klue incident one of the group’s biggest cases yet.
We still don’t know much about how they operate, the key players, or what their long-term goals are, this operation’s pretty new on the scene. Still, experts point out that Icarus seems fixated on business platforms and cloud systems. That lines up with what we’re seeing more and more from cybercriminals who want access to big pools of valuable corporate data.
What’s Next
The compromise of the Klue platform may have started in early June, according to Klue. They have already revoked access, so the attacker can’t do further damage.
Right now, it’s still unclear whether the 1GB of data stolen from Klue has surfaced online yet. But Klue is putting the necessary measures in place to ensure something like that never happens again. They’ve notified law enforcement about the incident and shared remediation tips directly with the victims.
Investigation into the full scope continues, but for now, they want anyone with questions to contact their security team directly.
