The threat actor claims to have compromised the Instituto Federal de Educação, Ciência e Tecnologia de Minas Gerais (IFMG) and is offering alleged Domain Admin access to the institution's infrastructure, including 17 campus domain controllers and VPN credentials. the alleged access includes Active Directory data (NTDS.dit), academic systems, financial and HR databases, enrollment records, and personally identifiable information (PII) such as names, CPF and RG numbers, contact details, hashed passwords, and academic transcripts.