The threat actor claims to be selling data from the Trilateral Cooperation Secretariat. The dataset allegedly contains approximately 400,000 lines, including IDs, names, email addresses, physical addresses, content engagement data, and other related information. Note: It was previously breached in April 2026.