OPM’s Database for Sale? Nope, It Came from Another US .Gov
Summary: A text file of more than 23,000 records with dot-gov email addresses was circulated on the Hell cybercrime forum and offered for sale as data from the OPM breach, but the initial entries all carried the unicor.gov domain, pointing to Federal Prison Industries instead. UNICOR public information officer Marianne Cantwell said the data appears tied to a September 2013 unauthorized access of its public website, which ran on ColdFusion and has since been replaced, and that the incident had not been previously disclosed publicly.
What's compelling: A government agency's user database, including hashed passwords, sat undisclosed for roughly two years before surfacing for sale on a Tor-only forum, and the misattribution to OPM shows how easily a leaked file's claimed origin goes unchallenged.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026