The group claims to have breached the official Kyivgaz customer portal by compromising a user portal subdomain and gaining access to the internal network. the attackers maintained persistent access, compromised multiple servers and Windows hosts, and exfiltrated personal data of approximately 1.25 million customers, commercial documents, and customer account credentials.