The Icarus ransomware group listed H* on its data leak site on 2026-06-23. Claim as published on the leak site: Salesforce data of H*. Data stolen: SF data - Compressed