Spreadsheet lists names, email addresses, phone numbers and passwords of US military and government staff, but marines say information is out-of-date

This article is more than 5 years old

This article is more than 5 years old

A group calling itself the Islamic State hacking division has published the details of 1,400 mostly US military and government personnel, urging supporters to attack those listed.

The spreadsheet, published online on Wednesday, exposes names, email addresses, phone numbers and passwords. Those listed include members of the marine corps, Nasa, the state department, air force and FBI.

Supporters of Isis on Twitter seized on the breach, posting personal details of soldiers and government staffers and encouraging lone wolves to “act and kill”.

A person claiming to speak for the group told the Guardian the information was obtained from military and government databases, a claim on which US army officials threw doubt.



Could Isis’s ‘cyber caliphate’ unleash a deadly attack on key targets? Read more

“This is the second or third time they’ve claimed that and the first two times I’ll tell you, whatever lists they got were not taken by any cyber attack,” the army chief of staff, Gen Ray Odierno, said on Wednesday.

“This is no different than the other two,” he said, referring to earlier so-called hacks by Isis supporters in January and May.

“But I take it seriously because it’s clear what they’re trying to do ... even though I believe they have not been successful with their plan,” he said.

A computer security expert, Troy Hunt, also cast doubt on the alleged hack, suggesting much of it could have been scraped from existing data breaches or publicly available information.

“It’s pretty clear that it’s been aggregated from different sources,” he said. “It’s been put together on the basis of a .gov or .mil address. Even the passwords, they’re not strong enough to have come from a corporate or government.

“They’re not even strong enough to have come from an online service - you can’t create a Gmail account, for example, with a password of less than eight characters, and here we’re seeing some passwords of three letters.”

The Pentagon said it was still looking into the incident.

Australians on Isis-aligned group's hit list include Victorian MP Read more

“We don’t really have much [information] because most of the email addresses appear to be really old and passwords listed in the tweet don’t match up with our password strength requirements,” marine Lt Col Jeffrey Pool said.

Among the first to post the spreadsheet was the hacker Junaid Hussain, reportedly third on a CIA “kill list” of Isis members and supporters.

The British national has been linked to the gunmen who attacked a prophet-Muhammad drawing contest in Texas in May.

Only the Isis leader, Abu Bakr al-Baghdadi, and its most prominent executioner, Mohammed Emwazi, are higher on the CIA list.

Also listed were at least eight Australians, including a member of the Victorian parliament and members of the Australian defence forces.