The threat actor claims to be selling unauthorized access allegedly belonging to VIPS Corretora de Câmbio S.A., a Brazilian foreign exchange brokerage regulated by the Central Bank of Brazil. The accessed data reportedly includes customer bank account information, taxpayer identification numbers (CPF), internal system credentials, signed contracts, financial records, employee information, and remote access to production servers.