If the feds wanted UDIDs, they'd have more than a meager 12 million... and I supposed they'd have it stored in a more efficient format than .csv. Then again, it could be a subset of data used for a specific SEEEEKRIT operation, dun-dun-dundun!
We probably won't know the real story behind this, but I don't doubt that the UDIDs are real, nor that the hax0rs have the additional information they claim they do. Could just as easily come from an exploited App-developer database, though.