International Operation Dismantles LeakBase Forum Used for Stolen Data Trading

• International law enforcement dismantles LeakBase forum used to trade stolen credentials online.
• Authorities seize databases and identify suspects after a global operation targeting cybercrime users.
• LeakBase hosted 142,000 users trading breached data and stealer logs since launching in 2021.

Authorities from the United States and several international partners have shut down LeakBase, an online forum widely used by cybercriminals to trade stolen data. The takedown followed an operation led by Europol and carried out across multiple countries between March 3 and March 4.

Investigators targeted the platform’s infrastructure and its most active users, disrupting a marketplace that had operated openly on the internet since 2021 and hosted large volumes of compromised credentials and breached databases.

Law enforcement agencies conducted arrests, searches, and investigative interventions during the operational phase, which focused on identifying individuals linked to the platform. On March 4, authorities seized the forum’s domain and replaced it with a law enforcement notice, effectively removing access to the service.

Forum Hosted Large Archive of Compromised Data

LeakBase functioned as a marketplace where cybercriminals could buy, sell, and exchange stolen information. The forum specialized in breached databases and “stealer logs,” which are collections of usernames, passwords, and other credentials gathered through infostealer malware.

Investigators said the platform stored an extensive archive of compromised data, including historical breaches and newly obtained datasets. The information was often used for account takeovers, online fraud, and additional cyber intrusions.

The forum operated in English and was accessible through the open web. Its internal system used credits and reputation scores to manage transactions between users and build trust within the platform’s community.

By December 2025, LeakBase had more than 142,000 registered users. Records from the platform showed approximately 32,000 posts and more than 215,000 private messages exchanged between participants.

Global Enforcement Actions Target Key Users

Authorities carried out around 100 enforcement actions worldwide during the investigation. Measures included arrests, house searches, and “knock-and-talk” visits directed at suspects believed to be active on the forum.

Law enforcement agencies focused on 37 individuals identified as some of the platform’s most active users. Investigators also seized the forum’s database, which enabled authorities to identify several participants who had attempted to remain anonymous online.

Europol Coordinates International Investigation

Europol supported the operation by analyzing the forum’s infrastructure and user activity. Analysts compared the data with ongoing investigations to identify links between suspects, victims, and digital evidence across jurisdictions.

An operational data sprint held at Europol headquarters in The Hague brought together specialists to analyze seized material and identify investigative leads. A data scientist worked with investigators to organize and extract millions of data points from the platform.

Related: Scammers Exploit Australia’s ‘ReportCyber’ Portal to Impersonate Police and Steal Crypto