A threat actor published a post on a dark web forum, claiming to have databases from Truist Bank. The threat actor indicates that the current price is at $1M but this sale is around $75K or nearest offers in order to sell the databases quickly.
According to the post, middleman is accepted and the price can be negotiated. The threat actor accepts payments in XMR (Monero). A Telegram handle and a TOX ID is included in the post and the threat actor wants buyers to use those channels or send messages from the forum.
The alleged databases include employee ID, names, email, address, job title, location. The alleged customer data includes account number, client name, loan amount, loan balance, marketing code, ACH start date, birthdate, advanced date, among various other information. The threat actor also included samples.
