Hacked Klue says criminals are deleting stolen customer data, but now other hackers are making threats

Klue, a market research firm, is embroiled in a troubling cyber incident that began with a significant data breach earlier this month. The firm disclosed that it is currently in discussions with the hackers responsible, who refer to themselves as 'Icarus.' According to Klue, this group has indicated that they are taking measures to delete the customer data they previously stole. In a private communication shared with its clients, Klue stated, "We continue to communicate with the threat actor we have been in contact with (‘Icarus’). Icarus informed us that they are actively working to delete the data taken from Klue customers." The Icarus website appears to be offline, reinforcing Klue's claims about the group's actions regarding the stolen data. The breach, which was confirmed by Klue on June 12, has affected multiple clients, including notable names like Gong, Jamf, and LastPass. Initially, the Icarus group threatened to release the stolen data unless a ransom was paid. However, as of now, it seems that they are indeed attempting to erase the data they obtained. Complicating matters, Klue reported that a second group of hackers is also attempting to extort the affected customers directly. This unnamed group has allegedly published a list of impacted companies on their own website, claiming to have gained access to Klue's customer data through Icarus. They further asserted that Klue had made a payment to an Icarus operator, who they claim is a teenager based in the UK. Klue has not confirmed any such payment, nor has it clarified the status of the Icarus website. The second gang of hackers has threatened to leak the data unless they receive a ransom. They asserted their claim by stating there are 195 affected Klue customers. In response, Klue advised its clients dealing with this new group to request a sample of the data as proof of their claims, asserting that Icarus has indicated this other group only possesses a subset of the data. The breach reportedly occurred due to the exploitation of a third-party credential from 2022, which allowed access to Klue's systems. The hackers utilized this access to steal authentication keys, enabling them to log into various cloud services and databases. However, Klue has yet to provide additional information regarding the compromised credential or why it remained active for so long.