The hacker Rawshark has rejected claims Facebook conversations between Papakura MP Judith Collins and blogger Cameron Slater are forgeries.
Instead, he has accused the pair of trying to spin their way out of the Dirty Politics storm.
The former Justice minister ramped up the stakes by accusing the hacker of creating forged conversations when quizzed over comments attributed to her and Slater.
The alleged conversations purportedly showed Ms Collins involved in conversations about the release of controversial SIS information before it was made public, and the possible leaking of police evidence.
She had she had "no record" of the conversations and told the Herald "you are likely to have been taken in by a criminal".
Through encrypted emails, the anonymous hacker yesterday accused Ms Collins and Slater of not being straight with the public.
"They think they can get away with it because they deleted the original Facebook account that Collins was using, so it doesn't have her name on it. That's stupid."
He said in his opinion, the content of the messages identified the "Facebook User" as Judith Collins, "clear as day".
Rawshark said the "same trick" was attempted when Dirty Politics was launched, when Slater denied receiving emails from the Prime Minister's press secretary Jason Ede. The hacker then released copies of email addresses under assumed identities which had been filed by Slater under Mr Ede's name.
Ms Collins did not respond to questions from the Herald, including how the forger had accurately described the timing of a telephone conversation Slater had taken part in.
Slater also did not respond.
However, a post yesterday on the Whale Oil site with the byline "SB" - understood to be Slater's wife - said that the hacker had "gotten desperate" and created the Facebook messages because other hacked material failed to do "as much damage as he had hoped".
Information sent to the Herald has provided a potential explanation on why the times of the alleged exchanges between Ms Collins and Slater appeared to be so late. Prior to the hack attack earlier this year, Slater's website was hosted on servers in the United States.
It meant the purported conversation regarding the Urewera's began at 4.23pm on Sunday afternoon rather than 12.23am - the time it was in the US.
Rawshark also forecast the possibility of more material yesterday.