The threat actor claims to be selling a database containing 8.38 million primarily U.S. payment card records. The listing states that most cards are inactive, and includes card details, cardholder information, addresses, phone numbers, emails, IP addresses, and other personal data.