The Icarus ransomware group reported a data breach involving CBAssociations in June 2026, claiming to have stolen Salesforce data. This alleged breach is part of a larger extortion campaign by Icarus, which has listed multiple organizations as victims following a reported supply chain compromise via Klue.
The Icarus group claims to possess Salesforce data ranging from 20 MB to 3.4 GB. However, the specific types of data compromised and the number of affected individuals have not been confirmed by CBAssociations or the ransomware group. No official notification has been issued by CBAssociations, and there are no reports of individuals being notified or attorney general filings.
Details surrounding this incident are still emerging, and official confirmation from CBAssociations or regulators has not been released. Organizations should monitor official sources for updates.