-
A hacker named “INS” says they hold 6.02 million records linked to the U.S. Department of Homeland Security.
-
The post says the data holds names, birth dates, government emails, password hashes, and IP addresses.
-
Nobody has confirmed the claim, and no proof shows the data truly came from DHS.
A hacker claims to hold millions of records linked to the U.S. Department of Homeland Security (DHS). The seller wants $10,500 for the full file. A post on X shared the claim publicly.
The post lists names, birth dates, and password hashes. A separate DHS cyber incident also made news earlier this year. This story covers both and shows what the evidence says so far.
Hacker Puts 6 Million Records Up for Sale
The seller goes by “INS.” This name belongs to a threat actor. That means a person or group behind a cyberattack. “INS” says they have a 1.98 GB file linked to DHS. The file reportedly holds about 6.02 million records. According to the X post, the seller wants $10,500 for the whole set.
The post also says the hacker released a free sample. That sample contains 582,911 records, less than a tenth of the full file. It gives a small look at the larger file. The post presents this sample as part of the offer.
The post names the kinds of details inside the records. They include names and dates of birth. They also list government email addresses and password hashes. IP addresses and account verification details appear on the list too. An IP address is a number that identifies a device on the internet.
All of these figures come from social media posts alone. Nothing else proves the data came from DHS. The records may not be real, and nobody has shown that a hack succeeded. The price and the file size also lack proof.
DHS Confirmed a Separate Cyber Incident
The claim arrives while another DHS problem sits in the news. According to a June 30 report, an unknown hacker entered the Homeland Security Information Network (HSIN). Government agencies and approved partners use this network. They share sensitive but unclassified information there. Unclassified means the information is not secret, yet it still needs care.
The report relied on people who knew about the incident. They said investigators were studying the break-in. DHS then confirmed a cyber incident. It involved an older, unclassified system for sharing information. Legacy systems like this are older tools that people still use.
A July 2 report said DHS was investigating the incident. The department did not share what the hackers took. It also gave no extra details when reporters asked follow-up questions.
Here is what the two reports confirm. DHS was investigating its own cyber incident. The reports do not connect that case to the data “INS” is selling. Neither report mentions the 6.02 million records, the 582,911-record sample, or the $10,500 price. The two stories therefore stay separate. One has an official DHS response, while the other has only a seller’s post.
Password Hashes and Phishing Raise Concerns
If the data is real, it could cause trouble for people and groups. A file with personal details, government emails, and password hashes carries risk. Both people and organizations could face these risks. Anyone whose details sit in the file could be affected.
Similar concerns arise when businesses suffer confirmed data breaches, as seen when global crypto travel platform Travala was hit by a data breach that exposed customer data.
Criminals could write convincing phishing messages, which are fake notes that trick people. They could also pretend to be officials, which means writing as if they work for the government. Some might try to log in to accounts with the exposed login details.
The listing mentions password hashes, so this point matters. Hashing is a way of hiding the real password. A password hash is a scrambled form of a password. It turns the password into a jumble of letters and numbers. It is not the same as the plain password. Still, weak or outdated scrambling methods can make some hashes easier to crack.
The real danger would depend on three things. The first is the hashing method. The second is how strong the passwords are. The third is whether the login details still work.
At this point, the evidence is too thin to say what the data is. One possibility is that the records are genuine. Another is that they came from an earlier leak. A third is that the seller mixed several datasets together. The last is that someone made the whole thing up. Reports reviewed found no outside confirmation of this listing. DHS has not confirmed this claim either.
The allegation should therefore stay labeled as an unverified leak claim, not a confirmed breach. Two things would help settle it. One is an official DHS statement. The other is an outside technical check of the sample. Experts would study it to learn two facts.
Authenticity means whether the records are real. Scope means how many records exist and which details they hold. Both steps need evidence that has not appeared yet. Until then, the 6.02 million figure remains only what the seller says.
