The threat actor claims to have leaked European domain credentials for Libero, containing email and password data in CSV format. The credentials were reportedly updated on 25 July 2026.