Law enforcement agencies worldwide have coordinated to take down one of the world’s largest hacker forums, scoring a victory against cybercrime.

BreachForums, a notorious marketplace for stolen data, was seized by the authorities on Wednesday, according to a message on its website.

BREACHFORUMS IS UNDER THE CONTROL OF THE FBI
This website has been taken down by the FBI and DOJ with assistance from international partners.

The message described how the authorities are “reviewing” the site’s “backend data” and inviting victims and anyone with information about cybercriminal activity on BreachForums to contact the FBI via Telegram, email, or the web.

The site was seized just days after a hacker offered data for sale on BreachForums that he claimed had been stolen during the breach of a Europol web portal.

Was the BreachForums takedown timed because the data stolen from Europol was a breach too far?

Until this week, BreachForums openly operated as a marketplace for criminals to trade stolen access devices, means of identification, hacking tools, breached databases, and other illegal services. The site, run by the ShinyHunters hacking group, was set up in June 2023, a month after its earlier incarnation was disrupted by the arrest of its creator and administrator, Conor Brian Fitzpatrick (also known as “pompompurin”).

21-year-old Fitzpatrick was sentenced to time served and 20 years of supervised release in January, banned from using the internet for the first year, and required to have monitoring software installed on his computer.

Fitzpatrick had created BreachForums after its predecessor, RaidForums, was shut down in April 2022, and its alleged administrator Diogo Santos Coelho arrested.

Are you noticing a trend? Hacking marketplaces are disrupted, their alleged administrators are arrested, and then new versions of the forums spring up to fill the void.

I wouldn’t be at all surprised if someone replicates the BreachForums marketplace, providing a forum for cybercriminals to trade stolen data illegally. But anyone participating on such sites should think very carefully. Law enforcement agencies have a history of seizing the data from criminal marketplaces like these and scouring them for details, which could lead them to identifying their users.

The seizure occurred shortly after BreachForums was used to leak data stolen from a Europol law enforcement portal. The website now displays a seizure message indicating the FBI’s control over the site’s servers, domains, and backend data. This data could potentially expose forum members and aid law enforcement investigations.

The FBI also seized the BreachForums Telegram channel and other channels owned by Baphomet, one of the site’s administrators. Messages sent from Baphomet’s account suggest his possible arrest and the seizure of his devices.

The FBI is actively seeking information from victims and individuals about BreachForums and its members. They have provided various channels, including email, Telegram, TOX, and a dedicated page on the FBI’s Internet Crime Complaint Center (IC3), for individuals to share information.

BreachForums has a history as a successor to several illicit hacking forums. It followed RaidForums, which was seized in 2015, and Breached, which was also seized by law enforcement. BreachForums gained notoriety for leaking stolen corporate data from various companies, including AT&T, 23andMe, and others.

The recent leak of data stolen from might have been the final straw, prompting law enforcement to take decisive action against BreachForums. The seizure message suggests that law enforcement may have been monitoring the site’s servers for an extended period, gathering evidence before taking action.

Editor’s Note: The opinions expressed in this and other guest author articles are solely those of the contributor and do not necessarily reflect those of Tripwire.