---
title: "Klue says the hackers who stole its customer data are deleting it, but a second group has emerged with extortion demands"
url: https://daily.dev/posts/klue-says-the-hackers-who-stole-its-customer-data-are-deleting-it-but-a-second-group-has-emerged-wi-m10djzwxj
source_url: https://thenextweb.com/news/klue-breach-icarus-deleting-data-second-hacker-group-extortion
type: article
source: "The Next Web"
published: 2026-06-25T18:14:30.943Z
updated: 2026-06-25T19:08:16.132Z
tags: ["cyber", "ransomware", "data-breach"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Klue says the hackers who stole its customer data are deleting it, but a second group has emerged with extortion demands

**[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments

## Summary

Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://thenextweb.com/news/klue-breach-icarus-deleting-data-second-hacker-group-extortion>

## Similar posts on daily.dev

- [Hacked Klue says criminals are deleting stolen customer data, but now other hackers are making threats](https://daily.dev/posts/hacked-klue-says-criminals-are-deleting-stolen-customer-data-but-now-other-hackers-are-making-threa-ot7wxtzlc) · TechCrunch · 0 upvotes · 0 comments
- [LastPass says hackers stole customer data through a supply chain breach at Klue](https://daily.dev/posts/lastpass-says-hackers-stole-customer-data-through-a-supply-chain-breach-at-klue-cot1tyrco) · The Next Web · 0 upvotes · 0 comments
- [Klue says hackers stole credential from 2022 that led to customer data breaches](https://daily.dev/posts/klue-says-hackers-stole-credential-from-2022-that-led-to-customer-data-breaches-vdzy86run) · TechCrunch · 0 upvotes · 0 comments
- [Klue hack results in data breach at several cybersecurity firms](https://daily.dev/posts/klue-hack-results-in-data-breach-at-several-cybersecurity-firms-9dzectjax) · TechCrunch · 0 upvotes · 0 comments
- [LastPass confirms data breach in Klue supply chain attack](https://daily.dev/posts/lastpass-confirms-data-breach-in-klue-supply-chain-attack-vv50ily4v) · BleepingComputer · 6 upvotes · 4 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#ransomware](https://daily.dev/tags/ransomware), [#data-breach](https://daily.dev/tags/data-breach)

[View this post on daily.dev](https://daily.dev/posts/klue-says-the-hackers-who-stole-its-customer-data-are-deleting-it-but-a-second-group-has-emerged-wi-m10djzwxj)