Last updated: 25 June 2026
It is never a great feeling when a cyber security company you work with appears on a ransomware leak site.
That was the position Huntress found itself in this week after data connected to the Klue breach was listed by the Icarus extortion group.
For those of us who work with Huntress, it was one of those moments that makes you sit up a bit straighter. Not because Huntress had suddenly become unsafe to use. The company has been clear that its products, infrastructure, telemetry, passwords and payment card data were not affected.
The issue, according to Huntress, sat elsewhere.
Klue, a market intelligence platform used by a number of businesses, was compromised. The attackers appear to have gained access through connected systems and exfiltrated data from downstream customers.
In Huntress’s case, the affected information was linked to Salesforce data. That included business contact details, product and subscription information, pricing, quotes, sales communications and opportunity notes.
Not ideal. Not something anyone would want published. But also not the same as a breach of the Huntress security platform.
That distinction matters, because ransomware leak sites are built to blur distinctions. They are designed to embarrass, pressure and frighten. A company name appears on a criminal website and the natural reaction is to assume the worst.
Since the original disclosure, the situation has moved on.
On 24 June 2026, Huntress said it was aware of new activity connected to the Klue incident. A separate unauthorised party has claimed access to data associated with the incident and has made statements about possible disclosure.
Those claims are currently unverified.
According to Huntress, the claims include a stated plan to publish sample information about companies that have engaged with the original Icarus threat actor. The claims also include the names of nearly 200 companies, followed by threats that information about victims will be released daily unless a “compromise” is made.
There is a big difference between confirmed impact, public disclosure and criminal claims made for pressure. Threat actors and copycat actors often use uncertainty as part of the attack. The aim is not just to leak data. It is to create fear, confusion and urgency.
So the right response is not panic.
The right response is to separate what is known, what is claimed, and what still needs verifying.
Public reports and company disclosures have already linked the Klue incident to a number of cyber and technology businesses. These include Huntress, Recorded Future, Tanium, Jamf, HackerOne, OneTrust, Snyk, Sprout Social, Gong, Insurity, BeyondTrust and LastPass.
That list alone shows why this incident deserves attention.
This was not a case of one small supplier affecting one customer. It was a supply chain issue involving a platform used by many businesses, including several security and technology companies.
The more interesting part of this story is how Huntress handled it.
They did not hide behind a vague holding statement. They published a detailed explanation, updated it as the situation changed, and were clear about what had and had not been affected. They also gave practical advice to other organisations that may have been caught up in the same incident.
That sort of openness is still too rare.
It is easy to talk about transparency when things are going well. It is much harder when your own name is involved.
There is a phrase used a lot in cyber security: “It’s not if, but when.”
I have never been a huge fan of it. It can sound a bit fatalistic, almost as though businesses should just accept they are going to be breached and carry on regardless.
That is not a particularly helpful message for a small business owner, a school business manager, a charity trustee or a care provider who is already juggling enough.
A better way to look at it is this: cyber security is about reducing the chances of something happening, reducing the damage if it does, and being ready to respond properly.
The Klue and Huntress incident is a good example of why that matters.
You can be a security company with strong controls and still be affected by something upstream. You can do a lot right internally and still be exposed through a supplier, platform, integration or old connection that no longer gets much attention.
That is the uncomfortable reality of modern business.
Most organisations are now built on other organisations. CRMs, finance systems, cloud storage, marketing tools, ticketing platforms, remote support tools, HR systems, email platforms, backup providers, IT companies and managed service providers.
Every login, integration and supplier relationship adds another small dependency.
That does not mean businesses should panic or stop using cloud services. It means supplier security needs to be treated as part of your own security, not something separate.
“The Klue incident is a reminder that modern businesses are built on other businesses. You can have strong internal controls and still be exposed through a supplier, CRM, integration or forgotten connection. Supplier risk is not paperwork. It is cyber security.” Kevin Walker
This is one of the reasons we keep talking about Cyber Essentials.
Cyber Essentials is not glamorous. It will not stop every attack. It will not remove supplier risk. It will not replace proper due diligence or incident response planning.
But it does give businesses a sensible baseline.
It makes you look at the basics that still matter: secure settings, access control, malware protection, patching, firewalls, cloud services and multi-factor authentication.
For many small organisations, that is exactly where the work needs to start.
It also gives you better questions to ask your suppliers.
Are they Cyber Essentials certified?
Do they use MFA?
How do they manage old accounts and integrations?
Who has access to your data?
What systems are connected to your CRM, email, files and finance platforms?
Are old OAuth apps, API keys and integrations reviewed and removed?
What happens if one of their systems is compromised?
How quickly would they tell you?
Those questions are not over the top. They are basic business hygiene now.
There is another lesson here too.
Sales data can still be useful to criminals.
A leaked price quote or CRM note may not sound as serious as a stolen password or payment card. But sales information can help make phishing emails more convincing. If a criminal knows who you deal with, what products you use, who your contacts are and what conversations have taken place, they have a better starting point for social engineering.
That is where these incidents can ripple out.
The first breach may be at a supplier.
The second attempt may arrive in your inbox.
That is why email security, staff awareness, MFA, password managers, payment checks and clear internal processes still matter.
It is also why businesses should pay attention to old integrations.
A tool may have been useful two years ago. A marketing platform may have been tested and forgotten. A CRM plugin may have been connected by someone who has since left. An OAuth permission may still be active long after the original reason for using it has disappeared.
Attackers love that kind of access because it often sits quietly in the background.
Nobody thinks of it as a doorway until someone walks through it.
Huntress being caught up in a supplier incident does not make me trust them less.
If anything, the way they have communicated has done the opposite.
Nobody wants to be named on a ransomware site. Nobody wants to explain that customer or partner data has been exposed through a third party. But when it happens, clear communication matters.
Say what happened.
Say what was affected.
Say what was not affected.
Say what people should watch for next.
Update people when the situation changes.
Be careful with unverified claims, but do not ignore them.
Huntress has done that.
The wider lesson for the rest of us is not that cyber security companies can be affected too, so why bother.
That is the lazy takeaway.
The real lesson is that cyber security has to include your supply chain. It has to include the tools you connect. It has to include the accounts you forgot existed. It has to include the third-party platforms sitting quietly in the background.
Cyber Essentials is not the whole answer.
But for many businesses, it is a good place to start asking the right questions.
And in a world where one supplier’s problem can quickly become your problem, asking better questions is not a bad thing.
