Threat actor claims to have breached Qara. The compromised data includes Firebase admin keys, Elasticsearch API keys, JWT session tokens, employee email addresses, plaintext employee passwords, phone numbers, Saudi governorate and district information, QR cash voucher data, wallet balances, deployment versions, feature flags, tenant names, build numbers, application configuration, supplier data, permission roles, IP addresses, user agents, and SSID hashes.