BreachForums (also known as Breached) is a notorious English-language cybercrime forum and marketplace that emerged in March 2022 as a successor to the seized RaidForums
. Over its volatile history, it has become a central hub for hackers to trade stolen databases, hacking tools, and personal identifying information (PII). Dark Reading Key Developments and Law Enforcement Actions
The forum has been the target of multiple international law enforcement operations, leading to several shutdowns and reboots: Original Era (2022–2023):
Founded by Conor Brian Fitzpatrick (alias "pompompurin"), the site grew to over 330,000 members. Fitzpatrick was arrested in New York in March 2023 and later sentenced to 20 years of supervised release. ShinyHunters Takeover (2023–2024): After the initial seizure, the hacking group ShinyHunters
and administrator "Baphomet" relaunched the site. This iteration was shuttered by the FBI and international partners in May 2024. Recent Seizures and Leaks (2025–2026): October 2025 breachforum
, another major takedown targeted the forum's backend infrastructure and escrow data. January 2026
, the forum itself suffered a "doomsday" data breach. A database containing records for roughly 324,000 users
—including email addresses, IP addresses, and private messages—was leaked online, potentially exposing the identities of numerous threat actors. March 2026
, international operations (such as the dismantlement of the related "LeakBase" forum) continue to pressure the cybercrime ecosystem. BreachForums (also known as Breached) is a notorious
Tiered Membership: Users registered for free, but a premium membership (via cryptocurrency payment) granted access to "Leaks VIP" sections, where the freshest, most valuable data was posted 48 hours before the general public.
The "Leaks" Section: The heartbeat of BreachForum. Here, users posted millions of rows of stolen data—everything from cracked Spotify accounts to full SQL dumps of government databases. Posts were often accompanied by sample data (e.g., "5k rows for verification") to prove legitimacy.
Marketplace for Tools: Beyond data, the forum hosted sales for ransomware builders, credential-stuffing software (OpenBullet configs), and zero-day exploits.
"General" & "Doxing": A significant ethical red line was crossed in the "Doxing" section, where users posted personal addresses, phone numbers, and family details of rivals or public figures. Key Features of the Platform:
Illegality: Many activities on such platforms are illegal. Law enforcement agencies worldwide work to monitor and dismantle these platforms.
Ethical Implications: Beyond legality, there are significant ethical concerns regarding privacy, cybersecurity, and the impact on individuals whose data is stolen and traded.
Encryption: Some platforms might offer end-to-end encryption for communications or use encryption to protect data shared on the site.
Verification Processes: To ensure the legitimacy or integrity of data being shared, some form of verification might be implemented.
Note: this post discusses an online forum associated with data breaches, criminal marketplaces, and the trade in leaked personal information. It focuses on factual context, operational methods, and broader impacts rather than glorifying wrongdoing.
They reveal how commodified stolen data has become and how quickly breaches cascade into broad harm. Understanding their operations helps defenders anticipate attacker workflows, prioritize protections, and shape policy and law-enforcement responses.