Cybercrime
,
Data Security
,
Fraud Management & Cybercrime
Group Resurrects Hacker Site Despite Multiple Law Enforcement Disruptions
Drama continues to come fast and furious in BreachForums land.
See Also: Gen AI Stalls, Shadow AI Rises: A CISO Concern
On Monday, the extortion group ShinyHunters announced the reboot of long-running BreachForums. Also known as Breached, the English-language forum facilitates hackers’ buying and selling of hacked databases, hacking tools and general cybercrime knowledge sharing.
Despite being repeatedly disrupted by law enforcement and occasionally, internal conflict, forums that focus on the buying, trading or selling of data dumps keep reappearing.
This week’s rebooted BreachForums followed “the BreachForums infrastructure, including the complete database and source code,” being “hacked directly from its own hosting server” and offered for sale for $10,000, according to its new administrator, a self-proclaimed member of the ShinyHunters data extortion group who goes by “X.” The new admin said that when “N/A,” the previous admin, “learned of the breach and the sale he panicked, took what he could and exited immediately with no notice to the community,” after which “the database has since spread into unknown hands.”
The panicking assertion appears to refer to a March 16 message posted to the previous version of the forum, announcing that “BreachForums is dead,” and seeking a replacement management team.
“We are now seeking a responsible individual or group willing to take over the leadership and ongoing support of the forum,” the message said.
Who’s hacking who remains difficult to track. Apparently as a result of last month’s breach of BreachForums, a hacker leaked on Telegram 918 databases of stolen information previously offered for sale on the forum. Many refer to household names, and contain people’s personal names, account usernames, email addresses, passwords, payment card details, job role or health information, said Milivoj Rajić, head of threat intelligence at cybersecurity firm DynaRisk.
He said the leaks include extensive data tied to historical breaches: Nvidia in 2022, Tesco in 2014, Experian and T-Mobile in 2015, Qatar National Bank in 2016 and even LinkedIn in 2012. But because many individuals never change their email address, this data can still be useful for attackers.
“These breaches were already public, but unlike dark web forums where access usually requires payment, they are now free and centralized in one place. The data includes both recent and older leaks from gaming, retail, sports sites and major companies. This centralization makes it easier for hackers to carry out large-scale attacks, including phishing, ransomware and potentially espionage, especially in the context of current geopolitical tensions,” he told me (see: Medtech Firm Stryker Disrupted by Pro-Iran Hackers).
At least two cybercrime forums bearing the banner of BreachForums are now online. They appear to be criminal competitors, but one or both might instead be a law enforcement honeypot.
On Monday, ShinyHunters’ X claimed their version is the only legitimate one, and said it’s been rebuilt from scratch after N/A allegedly fled the project, stealing $4,000. “Because the database is now in the possession of unknown people, we have made the difficult decision not to restore the original database. Instead, we have rebuilt the entire infrastructure from the ground up. It has been completely rewritten with much stronger security measures in place,” X claimed.
Time will tell. Law enforcement continues to disrupt and infiltrate cybercrime forums, including such marketplaces as RaidForums in 2022. That led directly to the launch of the first BreachForums as a replacement, until it too was disrupted in 2023 and its American administrator, Conor Brian Fitzpatrick, busted and later slapped with a three-year prison sentence.
Under the banner of ShinyHunters – originally the name of a completely different group of extortionists – a new BreachForums launched in 2023, followed by more law enforcement disruption and charges being filed against multiple accused operators (see: French Police Reportedly Bust Five BreachForums Administrators).
In 2025, an international law enforcement operation targeted and disrupted another such forum, called LeakBase. Last October, police disrupted another relaunched version of BreachForums.
On Jan. 9, a website with a ShinyHunters domain name published a database containing details of 323,986 registered BreachForums users. Cybersecurity firm Resecurity said it’s not clear how much of this data is legitimate, and that it’s likely “a method to plant disinformation by actors in order to mislead investigations.”
Resecurity said: “This information should not be interpreted as authentic in any way or form. With such publications, they build a ‘narrative’ to generate media interest and later use it to cause erroneous attribution or even craft a ‘story’ around their activities, often using misleading details.”
The latest version of BreachForums, launched this week, lists a number of previously announced ShinyHunters victims, ranging from Harvard University and the University of Pennsylvania to CarGurus to Panera Bread. The crime gang said it stole Salesforce customer data from those organizations through third parties, and that they refused to pay a ransom (see: Harvard, UPenn Data Leaked in ShinyHunters Shakedown).
How much money criminal operators might earn from offering stolen databases for sale remains an open question. It’s possible attackers see more value from such sites as a way to trumpet their previous hack attacks, build their brand and attempt to pressure future victims into paying (see: Madman Theory Spurs Crazy Scattered Lapsus$ Hunters Playbook).