Second hacker group demands ransom from Klue breach victims

Market intelligence platform Klue is now caught in a double extortion scenario after the original hackers behind its June 12 breach claim to be deleting stolen data while a second criminal group has surfaced demanding ransom from affected customers.

Icarus Steps Back, but a New Threat Appears

In a private customer update sent Wednesday night, Klue said it is in communication with Icarus, the cybercrime group that breached its systems and stole data from corporate customers by exploiting a compromised credential dating back to 2022. "Icarus told us they are taking steps to delete the data taken from Klue customers," the company wrote, according to TechCrunch, which obtained the communication and verified it with multiple sources. The Icarus website remained offline as of Thursday morning.tech.yahoo+1

However, Icarus informed Klue that a second, unnamed group of hackers obtained the stolen data by exploiting a mistake made by the Icarus operator. This second group has posted a list of allegedly affected companies on its own website and is demanding payment directly from victims. "Pay the ransom or we will leak everything if you no pay us," the second group wrote, claiming 195 affected Klue customers in total, according to TechCrunch.thenextweb

Major Firms Among Those Affected

The breach, which Klue first disclosed on June 19 and stems from an intrusion on June 12, has rippled through the cybersecurity industry. LastPass confirmed that hackers stole customer names, phone numbers, email addresses, physical addresses, and support case data through the Klue compromise. Huntress disclosed that business contacts, pricing quotes, and sales communications from its Salesforce ↘ 2.45% CRM were accessed. Recorded Future, HackerOne, Jamf, and Tanium are also among confirmed victims.techcrunch+4

The attackers used Klue's access to OAuth tokens — which connect customer data stored in platforms like Salesforce — to download and exfiltrate information. Klue has since engaged CrowdStrike ↘ 7.02% for incident response and disconnected its integrations to prevent further access.techcrunch+2

Klue Advises Customers Against Paying Second Group

Klue told customers that Icarus believes the second group possesses only data samples for a subset of customers, not the full dataset. The company relayed Icarus's recommendation that customers should not make payment to the second party. Klue is advising affected firms to request proof-of-data samples before engaging with any extortion demands.thenextweb+1

The incident underscores the cascading risks of supply chain breaches, where a single compromised vendor can expose dozens of downstream organizations — and where stolen data can change hands between criminal groups, multiplying the extortion threat.