Scope of Salesforce Attacks Expands as Icarus Leaks Data

The report details a wave of Salesforce data thefts stemming from a Klue integration compromise attributed to the extortion group Icarus. Multiple tech and security firms (including Huntress, LastPass, HackerOne, Recorded Future, Jamf, Snyk, Tanium, and others) reported exposed CRM records and some Gong integration user data; Icarus posted victims' data on a dark web leak site and set extortion deadlines. Affected organizations revoked Klue access, rotated API tokens, and warned of social‑engineering risks and potential exposure of secrets in Salesforce instances.