Hacker puts 350GB classified data stolen from US Marshals Service servers up for sale for $150,000

A hacker has put up for sale 350 GB of data stolen from US Marshals Service (USMS) servers, containing classified information. He expects to get $150,000 for this data.

According to the hacker, the archive contains documents of file servers and workstations from 2021 to February 2023, and there are no "exe files and libraries" in them. He wrote all this from the user account registered just one day ago.

These stolen files, according to the hacker, include photographs and aerial photographs of military bases and other heavily guarded areas, copies of passports and identity documents, as well as information about the wiretapping and tracking of people. It may also contain information about convicted criminals and gang leaders, as well as witnesses participating in the witness protection program.

The hacker also claims that some files are labeled as "CLASSIFIED" or "TOP SECRET."

The USMS is a US Department of Justice division that assists the US federal justice system by enforcing federal court orders, ensuring the safety of witnesses and their families, seizing ill-gotten assets, and performing a variety of other tasks.

Attack on the USMS...

As Bleepingcomputer.com reports, last month the USMS confirmed that it is investigating a “data exfiltration event" following the February 17 attack, in which hackers attempted to copy data from the USMS computer network using a special program.

However, department officials say the hackers were unable to access the USMS database’s Witness Security Files information system—also known as WITSEC, or the Witness Protection Program—during the attack. According to them, the hackers managed to access only the employees' personal database, but the attacked server was an autonomous system and was not connected to the department's internal network. According to the department, it has been disconnected, and the whole incident is being investigated.

What data is the hacker selling now? Did he manage to get those data during the February attack? Or did he carry out a new attack after that incident? Or are the data he has actually fake? All these questions are still unanswered.