By now you know that credit reporting agency Equifax was hacked, and with it, potentially 143 million Americans social security numbers, birth dates, and then some. Unless, according to the criminals who supposedly hacked them, Equifax pays up.

That’s according to an onion site, whose authors insist that if Equifax forks over 600 Bitcoin — approximately $2.66 million at the time of this writing — then they’ll delete all the stolen data. Oh, and Equifax better decide quickly, because if the ransom isn’t paid, the self-identified hackers say they’ll dump all the data on September 15th.

Well, almost all of the data. The supposed hackers wrote that they won’t publicly post credit card numbers—suggesting an intention to get some illicit use out of those.

“We are two people trying to solve our lives and those of our families,” the site explains. “We did not expect to get as much information as we did, nor do we want to affect any citizen. But we need to monetize the information as soon as possible.”

Now, you’d be right to be skeptical of these claims — after all, it’s pretty easy to throw together a website and pretend to be a hacker. However, there’s a twist: In a message addressed to Equifax the authors say they can prove they’re legit.

“Request a specific part or a specific data from an email that corresponds to Equifax and we will send it to you,” the group explains.

We’ve reached out both to Equifax and the person or persons behind the onion site, but haven’t received a response from either as of press time. We’ll update this when and if we hear back.

The purported hackers, meanwhile, appear to not be without a sense of humor — albeit, a twisted one. That 600 BTC ransom equalling roughly $2.6 million? Here’s how they claim to have arrived at the number.

“Equifax executives sold 3 million dollars in shares taking advantage of their insider information after the attack,” notes the site. “We believe that 600 BTC is a fair amount.”

That shade is a reference to the Equifax execs who sold around $1.8 mil in company stock after Equifax discovered the breach — but before it alerted the public.

While it’s too early to tell if this group is the real deal or just some scammers trying to make a quick few (million) bucks, ransoming hacked data is very much a thing. And on September 15, 143 million Americans may find out just how authentic this crew is. Here’s hoping Equifax is paying attention.