The FBI and Europol have shut down LeakBase, one of the world’s largest online marketplaces for stolen data and hacking tools, in a sweeping international operation that stretched across 14 countries and culminated in 13 arrests. The forum – which had quietly grown into a central pillar of the global cybercriminal ecosystem since launching in 2021 – is now offline, its domains replaced by law enforcement seizure banners and its entire database in the hands of investigators.
The takedown marks one of the most significant blows to the underground data-trading community in years.
What LeakBase Was – And How Big It Had Grown
LeakBase had been operating since 2021 and grew into one of the central hubs of the cybercriminal ecosystem. At its peak, the forum counted more than 142,000 registered members, hosted over 32,000 posts, and contained more than 215,000 private messages – all accessible on the open web, in plain English.
The platform specialised in the sale of stealer logs – archives of credentials harvested through infostealer malware – which could then be weaponised to conduct account takeovers, fraud, and broader cyber intrusions. Beyond stolen credentials, members could sell exploits and cybercrime services, and the forum also hosted dedicated spaces for programming, hacking techniques, social engineering, cryptography, and operational security guides.
LeakBase emerged as a significant force in 2023 after BreachForums – a predecessor platform – was shut down, with the site originally growing out of the ARES threat group’s infrastructure. One telling rule enforced on the platform: users were forbidden from publishing any data related to Russia – a restriction common among cybercriminal forums that observers say signals an implicit arrangement or tolerance by authorities in that region.
Operation Leak – How the Takedown Unfolded
The US Department of Justice and Europol announced the takedown on March 4, 2026, following two days of synchronised raids, arrests, and technical seizures that knocked the forum offline and replaced it with a law enforcement splash page.
Europol coordinated the operation from The Hague while the FBI’s Salt Lake City Field Office led the US side of the investigation. Search warrants were executed, arrests made, and interviews conducted across the US, Australia, Belgium, Poland, Portugal, Romania, Spain, and the UK.
The scale of what authorities seized was substantial. Law enforcement captured the forum’s entire database – including IP logs and private messages – and took direct action against 37 of its most active users.
FBI Deputy Director Brett Leatherman explained to The Record why LeakBase had been a priority target for several years before the operation launched. He described the forum as “a place where users were increasingly sharing information to access US networks, potentially critical infrastructure,” and characterised the typical victims as “victims of opportunity” – in many cases small and medium-sized businesses whose authentic credentials had been compromised and made available on the platform.
The operation marks the latest in a sequence of increasingly aggressive international actions against cybercriminal marketplaces, following the disruption of RaidForums in 2022, BreachForums in 2023, and the sentencing of the BreachForums founder in 2025.
The Suspected Administrator – A Russian Arrest With Complications
Three weeks after the forum went dark, a separate development added a significant twist to the story. Russian law enforcement arrested the suspected administrator of LeakBase – a resident of Taganrog, a coastal city in southern Russia – on charges of creating and managing a criminal site that enabled the trading of stolen personal databases since 2021.
Investigators from cybersecurity firms KELA and TriTrace linked the forum’s administrator to a 33-year-old individual operating under the aliases Chucky, beakdaz, Chuckies, and Sqlrip. Technical equipment and other evidence were seized during a search of the suspect’s residence
Russian Interior Ministry spokesperson Irina Volk confirmed the platform had hosted hundreds of millions of user accounts, banking details, usernames, passwords, and corporate documents obtained through hacking, and that over 147,000 registered users had used the site to buy and sell stolen data and conduct fraudulent acts against individuals.
There is, however, significant uncertainty about what happens next. Europol spokesperson Claire Georges told TechCrunch directly: “We don’t cooperate with Russian authorities and were not involved in the reported arrest.” Observers noted the suspect reportedly had never travelled abroad, and analysts suggest Russia is unlikely to extradite him to the West – raising the possibility that he may instead be pressed into working for the Russian state.
What This Means If Your Data Was on LeakBase
Europol used the occasion to stress a point that often gets lost in the drama of a forum takedown: stolen data does not simply vanish when a platform goes offline. It resurfaces elsewhere, continuing to fuel scams, identity theft, account takeovers, and targeted phishing. Both agencies urged individuals and organisations to use strong, unique passwords and to enable multi-factor authentication across all accounts.
Credential-stuffing attacks – where criminals use previously leaked passwords to attempt logins across multiple services – remain one of the most common downstream threats from forums like LeakBase. Anyone who reuses passwords across accounts is at heightened risk long after the original breach occurred.
For a broader view of how international cybercrime enforcement operations have evolved, Europol’s cybercrime overview tracks major actions across the EU and beyond.
The LeakBase takedown is a genuine win for law enforcement – but the pattern from previous forum shutdowns is clear: when one marketplace falls, others fill the gap. The investigation into the forum’s database, and the identities of its most active users, is still very much ongoing.
Leave a Reply
You must be logged in to post a comment.