Following a shutdown last week of the website of Idaho Fish and Game after indications of a hack, it was revealed on Friday that a hacker, dubbing himself Mr. High, announced he had stolen the personal details of 6.5 million people across Idaho, Washington, Oregon and Kentucky, according to the Post Register.

No evidence of his attaining the data has surfaced as of yet, but on Monday Mr. High claimed to have siphoned out personal information for 2.4 million users in Washington, 2.1 million in Kentucky, 1.2 million in Oregon and 788,000 in Idaho.

Active Network, one of the third-party vendors that handles some of the sites, said it patched the weakness “within 15 hours” and has hired a “top-tier cybersecurity firm to conduct a review.”

The FBI and Department of Homeland Security are on the case.