The threat actor claims to be selling an UK-based Morgan Sindall Group containing 9,000 user records with corporate and public email accounts. The listing states that the passwords are MD5-hashed.