[ For GroupLink (TOR), you need to change BAWANG with ONION, example: https://tegbmnhkbpqz637f2yd.bawang >> https://tegbmnhkbpqz637f2yd.onion ]
| Country | Discovered | Published | Group Name | Victim | Source | Description |
|---|---|---|---|---|---|---|
| 2026-06-23 | 2026-06-23 | ICARUS Google | Research | H* About Victim | Salesforce data of H*.
Data stolen: SF data - Compressed | ||
| 2026-06-23 | 2026-06-23 | ICARUS Google | Research | H** About Victim | Salesforce data for this corp.
Data stolen: SF data - compressed | ||
| 2026-06-23 | 2026-06-23 | ICARUS Google | Research | G* About Victim | Salesforce data for this corp.
Data stolen: SF data - compressed | ||
| 2026-06-23 | 2026-06-23 | ICARUS Google | Research | C* About Victim | Salesforce data for this corp.
Data stolen: SF data. Compressed size. | ||
| US | 2026-06-22 | 2026-06-22 | ICARUS Google | Research | HUNTRESS About Victim | Salesforce data of Huntress.
Data stolen: SF data - Compressed | |
| 2026-06-22 | 2026-06-22 | ICARUS Google | Research | HDS (HDSCORP) About Victim | Salesforce data for this corp.
Data stolen: SF data - compressed | ||
| 2026-06-22 | 2026-06-22 | ICARUS Google | Research | GMS-NET About Victim | Salesforce data for this corp.
Data stolen: SF data - compressed | ||
| 2026-06-22 | 2026-06-22 | ICARUS Google | Research | CQCRM About Victim | Salesforce data for Cqcrm
Data stolen: SF data - compressed | ||
| 2026-06-22 | 2026-06-22 | ICARUS Google | Research | CBASSOCIATIONS About Victim | Salesforce data for this corp.
Data stolen: SF data. Compressed size. | ||
| CA | 2026-06-19 | 2026-06-19 | ICARUS Google | Research | KLUE.COM About Victim | As you've probably already heard, ***.com has been impacted by us recently. A number of other companies' Salesforce instances, which were partners to Klue, were exfiltrated.
This leak/post is made to address this.
We advice Klue to contact us for a swift resolution, in order not to affect the companies you work with.
On the other note, if Klue doesnt want to accommodate this request, we advice the companies who want to protect their data to contact us via Session.
In order to verify you're a representative of the company you claim to be, you will need to provide a certain value/field from a row on your SF.
We wish for your cooperation, not your demise. Make the correct choice.
Data stolen: data borrowed - not stolen | |
| US | 2026-06-16 | 2026-06-16 | ICARUS Google | Research | THECREDITPROS.COM About Victim | TheCreditPros' Salesforce instance was breached and 263MB of data were taken from it, including:
01_input_fullcards.csv - 51,691 lines of full-info credit/debit cards: Id,First_Name__c,Last_Name__c,Middle_Name__c,Email__c,Credit_Card__c,CCV__c,Exp_Month__c,Exp_Year__c,SSN__c,DOB__c,Street_Address__c,City__c,State__c,Zip_Code__c,Mobile_Number__c,IP_Address__c,Transaction_ID__c,Status__c,CreatedDate
02_contacts_ssn.csv - 847,990 lines: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,HomePhone,SSN_hidden_field__c,Birthdate,MailingStreet,MailingCity,MailingState,MailingPostalCode,Status__c,Bank_Account_Number__c,Bank_Name__c,Bank_Account_Type__c,CreatedDate
03_creditcards.csv - 722,403 lines: Id,Card_number__c,card_number_hidden__c,cvv__c,expiration_month__c,expiration_year__c,Active__c,BIN__c,Issuing_Bank__c,Prepaid__c,CreatedDate
04_leads.csv - 3,598 liens: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,Street,City,State,PostalCode,Status,CreatedDate
Pay or leak!
Data stolen: PII, Credit cards | |
| ID | 2026-05-05 | 2026-05-05 | ICARUS Google | Research | CAZH.ID About Victim | - User DB: 300,000 Users (Email, Hash, Phone, Address, DOB) for https://bkdp.cazh.id/.
- KYC Vault: 7,800 Government IDs + 4,200 Selfies (including "Hold-to-Face" ID selfies).
- 34 SQL Databases for associated schools (Students/Parents/Staff).
- Corporate/Financial: Full Investor Database + partner documents
- Collateral documents (Vehicle Registration Documents & Property Deeds)
- Billing Proofs
- Full src code of their services
Data stolen: PII, SOURCE CODE, KYC |