Threat Actor Claims Ícaro Cloud Breach Exposed Data From 20 Client Networks
Summary
A threat actor claims to have breached Spain’s Ícaro Cloud using reused MSP credentials, exposing data from 20 client networks, including more than 3,500 OPNsense backups. The claim is unverified.
Key points
- A threat actor claims Ícaro Cloud S.L. in Spain was breached; the article provides no independent confirmation.
- The actor claims the alleged exposure spans 20 client networks and more than 3,500 OPNsense configuration backups.
- Reportedly exposed data includes firewall configurations, VPN secrets, TLS certificates, network segmentation details, administrator hashes and plaintext password references.
- The actor claims reused MSP credentials provided access and says the data is being offered for sale.
Article Details
- Victim Organization
- Ícaro Cloud S.L.
- Incident Type
- Alleged data breach involving reused MSP credentials
- Data Types Exposed
- Firewall configuration backups
- VPN secrets
- TLS certificates
- Administrator hashes
- Plaintext password references
- Internal network and segmentation data
- Affected Records
- The claim concerns 20 client networks and over 3,500 OPNsense configuration backups.
- Operational Impact
- Sensitive network configuration and credential material is reportedly exposed. Operational disruption is not reported.
- Ransom Or Extortion
- The threat actor claims the data is being offered for sale underground; no ransom demand is reported.
- Claim Status
- claimed