Loading story…
BreachForums went offline after the FBI reportedly arrested its alleged founder and administrator, known as “pompompurin,” on March 15, 2023, and charged him with conspiracy to commit access device fraud. All forum mirrors were inaccessible by March 20. In a March 21 update, replacement administrator Baphomet announced the forum’s closure over suspicions that law enforcement had compromised it; that suspected compromise was not independently confirmed. The prominent English-language cybercriminal forum had emerged after the takedown of RaidForums, which Europol announced in April 2022.
Baphomet proposed creating another Telegram group and working with competing forum administrators to establish a replacement community. ReliaQuest assessed that the shutdown would displace rather than eliminate cybercriminal activity, with users potentially moving to Russian-language forums and other channels to distribute stolen data. For defenders, the disruption does not establish that previously stolen information is contained: monitoring for exposed credentials and organizational data should extend beyond BreachForums to replacement communities and alternative distribution channels.
See the reporting duties and controls this puts on the clock.
10 events from the most recent confirmed update back to the earliest known activity.
BreachForums was inaccessible through all its mirrors as of March 20. The report linked the downtime to pompompurin’s arrest as a likely explanation but did not confirm an FBI seizure of the infrastructure.
Security researchers began reporting that the FBI had arrested the suspected founder and administrator of BreachForums.
The FBI reportedly arrested a 21-year-old New York man identified in an agent’s affidavit as pompompurin, BreachForums’ owner and administrator. The criminal complaint charged him with one count of conspiracy to commit access device fraud.
Pompompurin launched BreachForums to replicate RaidForums’ functionality and appearance. The new forum attracted many former RaidForums users.
Authorities arrested RaidForums’ founder and chief administrator. The arrest preceded the seizure of the forum’s infrastructure.
Pompompurin exploited a vulnerability in an FBI-owned email server to send thousands of fake emails concerning a cybercrime investigation.
RaidForums launched as a community that supported trading in account credentials, databases, and network access. It later became the predecessor to BreachForums.
Replacement administrator Baphomet announced that BreachForums was being shut down because they believed law enforcement had compromised it; the report did not independently confirm that claim. Baphomet also proposed another Telegram group and collaboration with competing forum administrators to build a replacement community.
Before the shutdown announcement, administrators said on Russian-language forums that they were migrating infrastructure and intended to restore BreachForums. One administrator attributed the downtime to precautions against internet scanning that could expose the actual hosts.
RaidForums’ infrastructure was seized through Operation TOURNIQUET following its founder’s arrest. Europol coordinated support for investigations involving the United States, United Kingdom, Sweden, Portugal, and Romania.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BreachForums, a cybercrime forum widely used to trade and leak stolen data, faced repeated disruption after administrators said they would shut it down over fears of law-enforcement infiltration. The closure concerns emerged after pressure on the forum's operators, underscoring growing operational risk for one of the most prominent marketplaces tied to breached databases and criminal data sales. Authorities later escalated that pressure by seizing BreachForums infrastructure in an FBI-led action, and subsequent reporting said French police arrested five alleged administrators linked to the site. The combined actions marked a sustained international crackdown on the forum's operators and supporting infrastructure, disrupting a major venue used by threat actors to advertise, sell, and publish compromised information.
Jun 29, 2026
A new **BreachForums** reboot appeared online with an administrator using the handle **"X"**, who claimed the forum had been rebuilt after its infrastructure, database, and source code were hacked from a hosting server and the prior operator **"N/A"** abandoned the project. The alleged revival was quickly disputed: **ShinyHunters** publicly denied any role in the new site and said it had not operated BreachForums since the FBI seizure in October 2025. Researchers also pointed to inconsistencies in X's account, raising doubts about whether the latest site is a legitimate successor, a copycat operation, or a setup using leaked forum data. The confusion comes amid a broader compromise tied to the BreachForums ecosystem, including the leak on Telegram of **918 databases** previously sold through the forum. Reporting said the exposed trove contains personal and sensitive data from numerous historical breaches, creating renewed opportunities for **phishing, ransomware, and espionage**. Multiple BreachForums-branded sites are now online, complicating attribution and increasing the possibility that some may be impersonation efforts, criminal competition, or potential law enforcement honeypots following repeated takedowns of major cybercrime forums.
Jun 29, 2026
U.S. and French law enforcement agencies, including the FBI and France’s BL2C cybercrime unit, have seized the primary domains of BreachForums, a notorious hacking forum operated by the ShinyHunters group. The forum, previously known for facilitating cybercriminal activity, had recently shifted its focus from a traditional discussion platform to a dedicated leak and extortion portal. This portal was being used to publish and threaten the release of data stolen from Salesforce and its corporate customers as part of an ongoing extortion campaign. High-profile companies such as Qantas, Disney, McDonald’s, and UPS were among the reported victims of this campaign, which relied heavily on social engineering tactics to compromise Salesforce accounts. The seizure notice, now displayed on the forum’s clearnet domain, features the logos of U.S. and French authorities, signaling the international cooperation behind the takedown. Despite the seizure of the clearnet site, the group’s onion (dark web) domain remains operational, continuing to threaten the release of stolen data. ShinyHunters, under the new moniker Scattered Lapsus$ Hunters, confirmed the loss of their infrastructure in a PGP-signed statement, acknowledging that all their domains and backend servers had been taken by law enforcement. They also admitted that database archives and escrow data dating back to 2023 are now under FBI control, effectively compromising years of criminal records and transactions. The group stated that no core administrators had been arrested, but they would not attempt to relaunch BreachForums, warning that such forums are now likely to be law enforcement honeypots. The seizure was timed to prevent the public release of sensitive Salesforce customer data, which the group had threatened to leak at a specified deadline. Law enforcement’s action represents a significant disruption to the infrastructure supporting ransomware and extortion operations targeting major corporations. The operation also highlights the ongoing evolution of cybercriminal tactics, as forums transition from discussion boards to direct extortion platforms. Despite the takedown, the threat actors insist that their Salesforce campaign remains unaffected, and their dark web leak site continues to list affected companies. The incident underscores the persistent threat posed by groups like ShinyHunters and the challenges faced by law enforcement in fully dismantling their operations. The seizure of BreachForums is the latest in a series of law enforcement actions targeting cybercrime forums, following previous takedowns such as RaidForums. The event demonstrates the importance of international collaboration in combating cyber-enabled extortion and data theft. Organizations affected by the Salesforce campaign are advised to monitor for potential data leaks and strengthen their security posture against social engineering attacks. The broader cybersecurity community is watching closely to see if the disruption of BreachForums will have a lasting impact on the underground economy or simply drive activity further underground.
Jun 29, 2026