The threat actor claims to be selling a database belonging to SNCF Connect. The compromised dataset allegedly contains approximately 473,000 records structured into three sections: Customer Contacts, Support Tickets, and Business Accounts. Exposed data includes customer Personally Identifiable Information (PII) such as full names, email addresses, phone numbers, physical addresses, dates of birth, and genders, customer support interactions, internal notes, and corporate account information.