Icarus ransomware group claims Salesforce data breach at Gms-net

• Ransomware group: Icarus
• Sector: Technology
• Announcement date: June 22, 2026

Icarus claims to have exfiltrated data from Gms-net

The threat actor known as Icarus has officially announced on its dedicated leak site that it has targeted the organization Gms-net. According to the post made on June 22, 2026, the group claims to have successfully exfiltrated sensitive information belonging to the company. This announcement follows a common pattern observed in modern cyberattacks where ransomware groups utilize leak sites to pressure victims through public exposure of stolen information.

In this specific instance, the Icarus group alleges that the data was obtained and moved in a compressed format. However, the group has not provided any detailed technical information regarding the specific timeline of the intrusion or the methods used to gain access to the environment. Furthermore, the announcement does not provide information regarding the total volume of data stolen or the specific number of files that were exfiltrated during the operation.

Details of the claimed data exfiltration

The claim made by the Icarus group focuses on a specific type of information. While the post mentions the exfiltration of data, the lack of accompanying screenshots or forensic evidence means that the full scope and the specific content of the stolen data cannot be independently verified at this time. The group has not disclosed a ransom demand or any specific instructions for the victim.

The data mentioned in the claim includes:

• Salesforce data

In the context of modern cyber threats, this type of activity is often associated with double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive data to threaten its public release. This increases the pressure on the victim, as the threat of a data leak can lead to significant regulatory and reputational consequences even if the organization can successfully restore its systems from backups.

Potential implications and risks

The claim that Salesforce data has been targeted suggests that Gms-net may face significant risks regarding the exposure of customer or operational information. Because Salesforce is a platform used to manage critical business processes, the exfiltration of data from this environment could potentially lead to the compromise of trade secrets or sensitive customer information. Such an incident could trigger complex compliance issues under relevant data protection regulations and may result in lasting damage to the organization's reputation.

Furthermore, there is a high probability that any leaked data could be utilized in secondary attacks. Stolen information is frequently repurposed by threat actors to conduct highly targeted phishing campaigns, where the attackers use specific details to appear legitimate to the intended victims. This secondary phase of an attack can extend the lifecycle of a single breach across multiple targets.

General defensive considerations

While information regarding the Icarus group remains limited in the public domain, this incident highlights the importance of robust security measures for organizations utilizing cloud-based platforms. To mitigate the risks associated with data exfiltration, organizations typically focus on implementing strict access controls, monitoring for unusual data movement, and ensuring comprehensive encryption of data both at rest and in transit. Maintaining a strong security posture is essential for protecting against the diverse tactics employed by ransomware groups in the current threat landscape.