The threat actor claims to be selling data from the Express Solutions Cuba. The compromised data reportedly contains id, user login, user pass, user nicename, user email, user url, user registered, user activation key, user status, display name.