Australians named on an Islamic State hit-list had their personal information stolen from an online retailer by a Malaysian-based hacker, according to the FBI.
Kosovo citizen Ardit Ferizi??? is accused of stealing personal information from 1351 people and passing it to a group calling itself the Islamic State hacking division.
The names, mobile phone numbers, email addresses, online passwords, and home suburbs of those who were hacked, including eight Australians, was published by the division in   August alongside the message: "We are extracting confidential data and passing on your personal information to the soldiers of the khilafah [caliphate], who soon with the permission of Allah will strike at your necks in your own lands!" 
The Australians on the list included a Victorian MP, a mother who is employed by the Australian Defence Force, employees or former employees of NSW Health, and an Australian National Audit Office employee.
The brother of a Defence force employee and a former Army reservist were also compromised.
 Fairfax Media reported in   August that four of the Australians who had their information hacked were not told by authorities about the threat. They had not be told about the hack until contacted by Fairfax Media.
It remains unclear whether Australian authorities were even aware the hack compromised citizens until Fairfax Media contacted them for comment, more than 10 hours after the information was posted.
In the US, some of those hacked - including former military personnel - were contacted directly by the Pentagon.
Mr Ferizi, 20, was arrested in Malaysia last month and is in custody while authorities apply for his extradition to the US.
It is alleged he stole the information from an online retailer and passed the information to notorious IS propagandist and fellow hacker Junaid Hussain, who was killed in a US air strike in Syria in   August, and another IS  member.
Hussain, who went by nom de guerre Abu Hussain al-Britani, was a close friend of Neil Prakash???, the Melbourne man who has risen to prominence as a recruiter for the terror group, and been linked to lone-wolf attack plots in Australia.
Prakash recently went to ground online, amid fears his internet activity could be traced and used by US forces, who reportedly have him on a list of key IS targets.
The FBI criminal complaint against Mr Ferizi alleges he was known online as Th3Dir3ctorY, and led a Kosovar hacking group despite living in Malaysia on a student visa since last year.
He is charged with providing material support to a designated terrorist organisation, computer hacking, and identity theft, and faces 35 years in prison.
The online retailer that was compromised is not named in the complaint, but the FBI state that its servers were hosted in Phoenix, Arizona. Several major retailers, including Amazon, are based in the city.
The hack was allegedly carried out "for the purpose of encouraging terrorist attacks against the identified individuals," according to the FBI.
US Assistant Attorney-General for National Security John Carlin said the case was the first of its kind.
"With these charges, we seek to hold Ferizi accountable for his theft of this information and his role in ISIL's targeting of US government employees," Mr Carlin, using an alternative term for IS, said.
"This arrest demonstrates our resolve to confront and disrupt ISIL's efforts to target Americans, in whatever form and wherever they occur."
The Australian Cyber Security Centre were tasked by Justice Minister Michael Keenan with investigating the hack.
Acting ACSC co-ordinator Joe Franzi confirmed the Australians were not been specifically targeted, but their information was published when it had been found on a compromised website.
There was no evidence that an Australian website had been breached as part of the hack, he said in a statement last month.
"Public websites are frequently targeted by malicious cyber actors and the compromise of personal information stored on these websites is likely to continue.
"We can all take steps to protect our personal information online. Individuals are reminded not to re-use their corporate or official credentials for personal use."