The threat actor claims to have leaked Fastweb credentials data containing emails, passwords, and service URLs. The data was updated on 20 July 2026 and reportedly includes accounts without MFA.