Alert this report is a summary of deep web and dark web source-based material and contains some facts that cannot be fully verified due to the nature of the sources. Major Issues BreachForums’ internal collapse and attempts to rebuild were observed. trust was undermined by the betrayal of moderators and the movement of funds, and […]

Alerts this report is based on reports of data breaches and the sale of initial access rights posted on deep web-dark web forums. some parts of the report contain information that cannot be fully verified as factual due to the nature of the source. Major Issues Multiple breach claims by ShinyHunters. a wide range of […]

Russian authorities arrested the alleged LeakBase admin for running a marketplace selling stolen data since 2021.

Russian law enforcement has arrested the suspected administrator of LeakBase, a cybercrime forum used to trade stolen personal data. The suspect, from Taganrog, is accused of running the platform since 2021. During a search of his home, authorities seized technical equipment and other evidence linked to the operation.

“Police have detained a Taganrog resident suspected of administering LeakBase, one of the largest hacker platforms. Law enforcement officials told TASS.” reported the Russian agency TASS. The detained Taganrog resident is suspected of administering “one of the largest international hacker platforms, LeakBase,” the agency’s source said.”

Active for four years, the platform had over 147,000 users who bought, sold, and used the data for fraud. A criminal case has been opened, and the suspect is in custody.

In early March, the Federal Bureau of Investigation seized the LeakBase cybercrime forum (leakbase[.]la), a platform used to trade hacking tools and stolen data. The action formed part of “Operation Leak,” an international effort coordinated by Europol involving authorities from 14 countries, who took control of the forum’s domains and posted seizure notices.

Active since 2021, LeakBase became a key hub in the cybercrime ecosystem, specializing in trading leaked databases and “stealer logs” containing credentials stolen by infostealer malware. Operating openly in English, the forum combined marketplace and discussion features, allowing cybercriminals to buy, sell, and exchange compromised data.

On March 3, law enforcement agencies carried out coordinated actions worldwide, including arrests, house searches, and about 100 interventions targeting 37 of the most active users of the LeakBase forum. The next day, law enforcement seized the platform’s domain and replaced it with a law-enforcement notice, marking the start of the disruption phase. Investigators now move into a prevention stage focused on deterring cybercrime and raising awareness.

Europol supported the operation by mapping the forum’s infrastructure and analyzing user activity, linking suspects, victims, and evidence across borders. Specialists at Europol’s headquarters in The Hague examined seized data and generated investigative leads. The effort took place within the Joint Cybercrime Action Taskforce, while a Joint Command Post coordinated real-time intelligence sharing during the global action.

Authorities seized the LeakBase database, allowing investigators to deanonymize multiple users who believed they operated anonymously. Officers also contacted suspects through the same online channels used for criminal activity, sending a clear warning that anonymity online is limited.

Investigators continue tracing digital evidence to identify additional offenders. The operation also highlights how stolen data from breaches often resurfaces on cybercrime forums and fuels scams, identity theft, account takeovers, and phishing, underscoring the importance of strong passwords and multi-factor authentication.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LeakBase cybercrime forum)

ASEC Blog publishes Ransom & Dark Web Issues Week 4, March 2026           Japanese Automaker Suffers Personal Data Breach via Unauthorized External Access INC Ransom Targets South Korean Steel Manufacturer in Ransomware Attack LeakBase Forum Administrator Arrested in Russia

ASEC Blog publishes Ransom & Dark Web Issues Week 3, March 2026           New Threat Actor CipherForce Claims Cyberattack on South Korean Job Portal New Threat Actor Loki Emerges, Leaks US Citizens’ Personal Data Cybercrime Forum LeakBase Shut Down Again by Russian Authorities

The Federal Bureau of Investigation seized the LeakBase cybercrime forum in an international crackdown led by Europol.

The Federal Bureau of Investigation seized the LeakBase cybercrime forum (leakbase[.]la), a platform used to trade hacking tools and stolen data. The action formed part of “Operation Leak,” an international effort coordinated by Europol involving authorities from 14 countries, who took control of the forum’s domains and posted seizure notices.

Active since 2021, LeakBase became a key hub in the cybercrime ecosystem, specializing in trading leaked databases and “stealer logs” containing credentials stolen by infostealer malware. Operating openly in English, the forum combined marketplace and discussion features, allowing cybercriminals to buy, sell, and exchange compromised data.

“Active since 2021, LeakBase maintained a vast and continuously updated archive of breached databases, ranging from historical leaks to newly compromised data.” reads the press release published by Europol. “By December 2025, LeakBase counted more than 142 000 registered users, approximately 32 000 posts and over 215 000 private messages, underlining its scale and global reach.”

On March 3, law enforcement agencies carried out coordinated actions worldwide, including arrests, house searches, and about 100 interventions targeting 37 of the most active users of the LeakBase forum. The next day, law enforcement seized the platform’s domain and replaced it with a law-enforcement notice, marking the start of the disruption phase. Investigators now move into a prevention stage focused on deterring cybercrime and raising awareness.

Europol supported the operation by mapping the forum’s infrastructure and analyzing user activity, linking suspects, victims, and evidence across borders. Specialists at Europol’s headquarters in The Hague examined seized data and generated investigative leads. The effort took place within the Joint Cybercrime Action Taskforce, while a Joint Command Post coordinated real-time intelligence sharing during the global action.

On March 3, law enforcement agencies carried out coordinated actions worldwide, including arrests, house searches, and about 100 interventions targeting 37 of the most active users of the LeakBase forum. The next day, authorities seized the platform’s domain and replaced it with a law-enforcement notice, marking the start of the disruption phase. Investigators now move into a prevention stage focused on deterring cybercrime and raising awareness.

Europol supported the operation by mapping the forum’s infrastructure and analyzing user activity, linking suspects, victims, and evidence across borders. Specialists at Europol’s headquarters in The Hague examined seized data and generated investigative leads. The effort took place within the Joint Cybercrime Action Taskforce, while a Joint Command Post coordinated real-time intelligence sharing during the global action.

Authorities seized the LeakBase database, allowing investigators to deanonymize multiple users who believed they operated anonymously. Officers also contacted suspects through the same online channels used for criminal activity, sending a clear warning that anonymity online is limited.

Investigators continue tracing digital evidence to identify additional offenders. The operation also highlights how stolen data from breaches often resurfaces on cybercrime forums and fuels scams, identity theft, account takeovers, and phishing, underscoring the importance of strong passwords and multi-factor authentication.

Authorities from 14 countries participated in the investigation: Australia, Belgium, Canada, Germany, Greece, Kosovo, Malaysia, the Netherlands, Poland, Portugal, Romania, Spain, the United Kingdom, and the United States.

“This operation shows that no corner of the internet is beyond the reach of international law enforcement. What began as a shadowy forum for stolen data has now been dismantled, and those who believed they could hide behind anonymity are being identified and held accountable. This is a clear message to cybercriminals everywhere: if you traffic in other people’s stolen information, law enforcement will find you and bring you to justice.” said Edvardas Šileris, Head of Europol’s European Cybercrime Centre.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LeakBase cybercrime forum)

An international law enforcement operation has dismantled LeakBase, a major online marketplace for stolen data that had become a central hub for cybercriminal activity. The cybercrime forum dismantled during the coordinated crackdown had amassed more than 142,000 registered users and hosted thousands of posts offering leaked databases and stolen credentials. The operation, coordinated by Europol, targeted the infrastructure of the platform as well as several of its most active users. Investigators carried out coordinated enforcement actions between 3 and 4 March, marking one of the latest global efforts to disrupt the underground economy that thrives on stolen personal and corporate data. Authorities say the cybercrime forum dismantled operation significantly disrupted a platform that had been widely used by criminals to trade compromised information and facilitate further cyberattacks.

LeakBase: A Growing Marketplace for Stolen Credentials

Active since 2021, LeakBase operated openly on the web and primarily used English, allowing it to attract a global community of cybercriminals. The forum specialised in trading leaked databases and so-called “stealer logs,” which are collections of credentials captured by infostealer malware. These logs typically contain email addresses, passwords and other authentication data that criminals use to access online accounts. Once obtained, the information can be used for account takeovers, fraud schemes and further cyber intrusions. [caption id="attachment_109931" align="aligncenter" width="1024"] Image Source: Europol[/caption] Over time, LeakBase developed a structured system that helped it grow rapidly. The forum used a credit-based economy and reputation system, allowing users to build credibility within the community and gain access to more valuable data. This system helped maintain trust among offenders and kept the marketplace active. Despite being an international platform, LeakBase reportedly had an internal rule that prohibited the sale or publication of data related to Russia, highlighting the unusual dynamics that sometimes exist within cybercrime networks. By December 2025, the forum had accumulated more than 142,000 registered users, around 32,000 posts, and over 215,000 private messages, underscoring its role as a major player in the underground data-trading ecosystem.

Coordinated Global Action Against the Cybercrime Forum

The cybercrime forum dismantled operation involved law enforcement authorities from several countries, including Australia, Belgium, Canada, Germany, Greece, Malaysia, the Netherlands, Poland, Portugal, Romania, Spain, the United Kingdom and the United States. On 3 March, authorities launched coordinated enforcement actions that included arrests, house searches and “knock-and-talk” visits targeting individuals suspected of being heavily involved in the forum’s activity. Around 100 enforcement actions were conducted globally, with investigators focusing on 37 of the most active users of the platform. The following day, authorities moved to the technical disruption phase of the operation. Investigators seized the forum’s domain and replaced the website with a law enforcement notice, effectively shutting down the platform and preventing further activity. Officials say the investigation is now entering a prevention phase that aims to deter others from engaging in similar cybercrime operations.

Europol’s Role in Tracking the Forum

Europol analysts played a key role in the investigation by mapping the infrastructure of the LeakBase forum and analyzing user activity across the platform. Investigators cross-matched the forum’s data with ongoing cases across Europe and other regions, helping identify suspects and connect digital evidence across multiple jurisdictions. At Europol’s headquarters in The Hague, a dedicated operational data sprint brought together specialists to process the seized information quickly. A data scientist also supported the investigation by structuring millions of data points to generate actionable leads for law enforcement teams. The operation was carried out within the framework of the Joint Cybercrime Action Taskforce (J-CAT), which supports international cybercrime investigations.

Anonymity in Cybercrime Is Often an Illusion

Authorities say the investigation also exposed how fragile anonymity can be within the cybercrime world. By seizing the forum’s database, investigators were able to identify and deanonymise several users who believed they were operating under complete anonymity. In some cases, investigators contacted suspects directly through the same online channels that had been used to facilitate criminal activity. Edvardas Šileris, Head of Europol’s European Cybercrime Centre, said the operation sends a clear signal to cybercriminals operating online. “This operation shows that no corner of the internet is beyond the reach of international law enforcement. What began as a shadowy forum for stolen data has now been dismantled, and those who believed they could hide behind anonymity are being identified and held accountable. This is a clear message to cybercriminals everywhere: if you traffic in other people’s stolen information, law enforcement will find you and bring you to justice.”

Stolen Data Rarely Disappears

Investigators also warn that the shutdown of LeakBase highlights a broader reality about cybercrime. When organizations or individuals suffer a data breach, the stolen information often resurfaces on underground platforms where it can be reused for scams, phishing campaigns or identity theft. While the cybercrime forum dismantled operation is a significant step, experts caution that similar marketplaces can quickly emerge to replace them. For individuals, authorities emphasize the importance of basic cybersecurity hygiene, including using strong and unique passwords and enabling multi-factor authentication to reduce the risk of compromised accounts.