LeakBase Cybercrime Forum Seized, FBI Captures Data of 142K Members

Authorities have dismantled the LeakBase cybercrime forum in a coordinated international law enforcement operation. Investigators also seized the platform’s internal database, which contains records connected to more than 142,000 registered members.

The takedown represents a significant disruption to a platform that played a key role in the online trade of stolen credentials and hacking tools. By gaining access to the forum’s internal data, investigators now have valuable intelligence about the users who relied on the platform to exchange cybercrime resources.

International Operation Shuts Down LeakBase

Law enforcement agencies shut down the LeakBase cybercrime forum as part of a coordinated international effort known as Operation Leak. Authorities seized the platform’s infrastructure and replaced the website with an official law enforcement notice announcing the operation.

The investigation involved agencies from multiple countries working together to target a platform that had become widely used among cybercriminal communities. The operation also included enforcement actions against several individuals believed to be connected to the forum.

Investigators conducted searches and seized additional infrastructure linked to the platform during the operation. These steps aim to prevent the forum from quickly reappearing under the same operators.

A Marketplace for Stolen Data and Hacking Tools

LeakBase functioned as an online marketplace where cybercriminals could exchange stolen information and hacking resources. Unlike some underground forums that operate exclusively on the dark web, LeakBase was accessible through the regular internet, which helped it attract a large number of users.

The forum became known for distributing stealer logs, which are archives of credentials collected by infostealer malware. These logs typically contain usernames, passwords, cookies, and session tokens taken from infected devices.

Cybercriminals frequently use this information to carry out additional attacks. Access to stolen credentials allows attackers to compromise accounts, bypass authentication systems, and gain entry into corporate networks.

The data traded on platforms like LeakBase often fuels a wide range of cybercrime activities, including:

• Account takeover attacks
• Financial fraud and identity theft
• Corporate network intrusions
• Reselling access to compromised systems

When large datasets circulate through cybercrime forums, the same compromised accounts can be exploited repeatedly by different threat actors.

Database of 142,000 Members Captured

A major outcome of the operation is the seizure of LeakBase’s internal database. Investigators confirmed that the captured data includes records tied to approximately 142,000 registered members.

The database also contains large volumes of messages exchanged between users of the forum. These conversations may provide insight into cybercriminal operations, collaborations between threat actors, and the methods used to distribute stolen data.

Law enforcement agencies will likely analyze the information to identify suspects and map relationships across the cybercrime ecosystem. Similar forum takedowns in the past have led to additional arrests months or even years after the initial seizure.

The seized data may also help investigators uncover other cybercrime platforms that share members or infrastructure with LeakBase.

Part of a Broader Strategy Against Cybercrime Forums

The shutdown of LeakBase reflects a broader strategy used by international authorities to disrupt cybercrime marketplaces. Rather than focusing only on individual attackers, investigators increasingly target the platforms that allow criminals to collaborate and trade stolen data.

Taking down these forums removes key infrastructure that supports large parts of the cybercrime economy. It also provides investigators with valuable intelligence about how threat actors operate and communicate.

Despite these successes, new cybercrime forums often appear after older ones are dismantled. Online criminal communities frequently migrate to alternative platforms or launch new marketplaces to replace those that authorities shut down.

Final Thoughts

The seizure of the LeakBase cybercrime forum marks a major disruption to a platform widely used for distributing stolen credentials and hacking tools. By capturing the forum’s database of 142,000 members, investigators now have a detailed view of a large network of cybercriminal users.

Operations like this demonstrate how coordinated international efforts can dismantle key cybercrime infrastructure. At the same time, the continued emergence of new underground forums highlights the ongoing challenge of combating the digital marketplaces that enable cybercrime.