Looks fake. It's quite impressive that they managed to hack more users from us than even exist. 🙃
Discussion
So that actors had multiple real breeches and auctions but this one is fake because the reported accounts dont match?
The specific set of data doesn't make sense either. If they were able to retrieve password hashes then I'd expect they'd have all of the user fields, which they're not claiming to have.
If the threat actor wishes to prove the veracity of their claim, they should post a sample of the actual data.
Go request it looks like they do
I had to double check, lol its reporting lines of data not users so. Let's try again