The threat actor claims to be selling data from Sephora. The compromised data reportedly includes approximately 15 million customer records containing member IDs, names, email addresses, phone numbers, dates of birth, postal and billing addresses, loyalty program details, purchase history, preferred stores, communication preferences, reward points, and related customer account metadata