Threat actor claims to be selling root-level CMS access to an unidentified healthcare IT company in the United States. The advertised access reportedly provides full administrative capabilities, including user management, file uploads, email account creation, and other CMS functions.