Global Law Enforcement Shuts Down LeakBase Cybercrime Forum

An international law enforcement operation has successfully taken down LeakBase, one of the world’s largest online forums used by cybercriminals to trade stolen data and hacking tools.

The operation was led by the Federal Bureau of Investigation with support from international partners, according to the United States Department of Justice. The takedown targeted the forum’s infrastructure and administrators as part of a coordinated global effort to disrupt cybercrime marketplaces.

Users attempting to visit the forum’s website leakbase[.]la are now shown a seizure banner confirming that the platform has been confiscated by authorities.

________________________________________



LeakBase Forum: A Major Cybercrime Marketplace

Before its shutdown, LeakBase had grown into a massive cybercrime community.

Key statistics revealed by investigators include:

• Over 142,000 registered members

• More than 215,000 forum messages

• Active marketplace for stolen databases and cybercrime tools

The platform allowed criminals to buy and sell compromised data such as:

• Account credentials

• Credit and debit card numbers

• Bank account and routing information

• Usernames and passwords

These stolen records were often used for account takeover attacks, financial fraud, and identity theft.

Authorities confirmed that all forum data — including user accounts, posts, private messages, payment details, and IP logs — has been secured and preserved as evidence.

________________________________________

Forum Activity and Rules

LeakBase had been active since June 2021 and operated openly on the clearnet, making it easily accessible to cybercriminals worldwide.

Interestingly, a 2023 report from the cybersecurity company Flare Systems revealed that the forum had a strict rule: users were not allowed to sell or publish Russian databases. Experts believe this policy was intended to reduce attention from certain authorities.

The forum specialized in selling stealer logs, which are archives of credentials collected by infostealer malware.

According to Europol, these logs often contain sensitive information harvested from infected devices and can be used to conduct:

• Account takeover attacks

• Fraud and financial theft

• Network intrusions

________________________________________

Key Figures Behind LeakBase

Investigators believe the forum was operated by a cybercriminal known as Chucky, who also used aliases such as Chuckies and Sqlrip across underground forums.

Threat intelligence firm SOCRadar reported that the actor has a long history of distributing massive stolen database collections from organizations worldwide.

Other administrators and moderators linked to the forum include:

• BloodyMery

• OrderCheck

• TSR

Security researchers from SpyCloud had previously noticed the forum experiencing downtime shortly before the takedown. Reports suggested that its operator was actively searching for a new hosting provider, indicating possible technical or security issues.

________________________________________

Operation Leak: Global Crackdown on Cybercrime

The takedown was part of a law enforcement campaign called Operation Leak, which took place between March 3 and March 4, 2026.

Authorities conducted coordinated actions across multiple countries, including:

• United States

• Australia

• Belgium

• Poland

• Portugal

• Romania

• Spain

• United Kingdom

During the operation:

• Search warrants were executed

• Arrests were made

• Interviews were conducted

According to Europol, nearly 100 enforcement actions were carried out worldwide, and measures were taken against 37 of the platform’s most active users.

________________________________________

FBI Statement on the Takedown

Assistant Director Brett Leatherman from the Cyber Division of the Federal Bureau of Investigation confirmed that the operation resulted in the seizure of key data from the platform.

Investigators have collected:

• User account records

• Private messages

• Credit details

• IP logs

These records will now be used to identify additional cybercriminals and support future prosecutions.

________________________________________

Conclusion

The shutdown of LeakBase marks a significant victory for global law enforcement in the fight against cybercrime. By dismantling a major marketplace for stolen data, authorities have disrupted a key infrastructure used by hackers and fraudsters worldwide.

However, cybersecurity experts warn that similar platforms may emerge in the future, highlighting the need for continued international cooperation and stronger cyber defenses.