The threat actor claims to be selling unauthorized access to a U.S.-based tax service organization through VNC access.the compromised environment operates on Windows 11 and is protected by Microsoft Defender.The threat actor further claims that the access provides exposure to a customer database containing approximately 1,963 customer records and includes access to the Drake Tax 2025 software platform.