The threat actor claims to be selling data allegedly belonging to Dar Al‑Handasah. The compromised data reportedly includes employee PDF files, internal project documents, employee portal access, Saudi government‑related project data, and session cookie