BreachForums, a key English-language cybercrime forum, seized by the FBI

The takedown comes nearly a year after the site was reconstituted after a previous seizure. 

The FBI, the Department of Justice and a range of international law enforcement agencies seized on Wednesday a notorious website used to buy and sell stolen and hacked data. 

The operation to seize BreachForums is the second time in the past year that authorities have seized the site. A previous iteration was seized in June 2023, after U.S. authorities arrested Conor Fitzpatrick, the creator and administrator of the site where cybercriminals bought and sold hacked and stolen data, compromised credentials, and more. Within a month of the seizure, BreachForums was reconstituted and has been operational ever since.

A seizure notice posted to the site Wednesday said the site had been seized by the FBI and the DOJ, along with enforcement agencies in the U.K., New Zealand, Australia, Switzerland, Ukraine and Iceland.

Paul Foster, the director of threat leadership at the U.K.’s National Crime Agency, told CyberScoop in a statement Thursday that the NCA “assisted an FBI investigation into BreachForums,” and that “intelligence development and domain takedown assistance was provided.”

“Such criminal marketplaces are a key enabler of the cybercrime ecosystem, providing a means for threat actors to advertise their services,” Foster said. “The NCA and its international partners will continue to collaborate on this type of activity, using the full range of law enforcement tools available to maximise disruptive impact against this threat,” he said. 

The seizure includes BreachForums’ Telegram channel, as well as the channel operated by a persona known as Baphomet, a BreachForums admin under Fitzpatrick prior to his arrest, and the one who led the site’s resurgence. 

It’s not clear whether the operation only involves the seizure of just the site and Telegram channels, or whether there have also been any arrests. 

The FBI also set up a reporting form asking for information related to BreachForums in any of its iterations. 

“From June 2023 until May 2024, BreachForums (hosted at breachforums.st/.cx/.is/.vc and run by ShinyHunters) was operating as a clear-net marketplace for cybercriminals to buy, sell, and trade contraband, including stolen access devices, means of identification, hacking tools, breached databases, and other illegal services,” the form reads. 

The FBI did not immediately respond to a request for comment Wednesday.

Updated May 16, 2024: This article has been updated with a statement from the National Crime Agency.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• FBI raises alarm over deceptive phishing campaign targeting prominent people

• McKesson copes with fallout from data theft extortion attack

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure