The threat actor is selling allegedly stolen USA payment card data, including 500 credit card records without CVV2 and 500 records with CVV2. The datasets reportedly includes card details, cardholder information, email addresses, passwords, browser user-agent strings, and IP addresses.