BreachForums Takeover Allegedly Orchestrated by Law Enforcement, ShinyHunters Say

• BreachForums breach: Threat actor ShinyHunters claimed that law enforcement took control of key BreachForums admin accounts.
• Who was exposed: The reported takeover affected the accounts of Hollow and ShinyHunters.
• What leaked: Their message stated law enforcement accessed private messages, passwords, IPs, and email addresses.

Notorious threat actor ShinyHunters has announced that the infamous BreachForums has been compromised and allegedly taken over by international law enforcement, including French BL2C and the U.S. Department of Justice (DOJ), with support from the FBI. The reported infiltration affects key administrator accounts.  

Alleged Takeover Details  

According to dark web claims by ShinyHunters, administrator accounts tied to Hollow, ShinyHunters, and a so-called "Founder" (possibly a federal agent) are now under law enforcement control, as reported by HackManac. The hacker forum was taken offline following this announcement.

The data breach reportedly exposed information collected since the platform's relaunch:

• plaintext passwords
• IP addresses
• email addresses
• all private messages
• other sensitive metadata

Further claims suggest the forum’s source code has been modified to log all user actions, effectively turning BreachForums into a monitored law enforcement honeypot. 

This enhanced surveillance implicates previous activities and compromises any new interactions on the site.  

Implications for Forum Users  

ShinyHunters has cautioned against engaging with any future iterations of BreachForums, labeling them as potential law enforcement traps. For participants in the cybercrime forum, the exposure of private communications and activity logs could have severe legal consequences, fostering distrust within other criminal platforms.  

While a BreachForums takeover would represent a significant success for global law enforcement, it also highlights the risks faced by those engaging in illicit marketplaces and their increased vulnerability to sophisticated policing efforts.  

In June, French Police disrupted BreachForums as the U.S. indicted British cyber kingpin "IntelBroker" and four other French hackers, who operated under the pseudonyms "ShinyHunters," "Hollow," "Noct," and "Depressed," were arrested.

Related

ClickFix PowerShell Attack Chain Leverages Email Invite Lures, Spoofed MS Teams Login Pages

BlackSuit Ransomware Takedown Disables 9 Domains and 4 Servers, Seizes $1M

Kimsuky APT Hackers Exposed in Alleged Breach Revealing Phishing Tools and Operational Data

Carmaker Web Portal Exposes Remote Car Unlocking Vulnerability and Access to 1,000 Dealerships

Four Zero-Click DoS Flaws Abuse Windows RPC and LDAP to Launch Large-Scale DDoS via Domain Controllers

Qilin Ransomware Claims Formacompany & Co. Real Names Leak, Accuses the Offshore Company of Money Laundering

Your Weekly Cybersecurity Briefing

Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.

Subscribe for Free

Please enter a valid email address.

Most Popular

ClickFix PowerShell Attack Chain Leverages Email Invite Lures, Spoofed MS Teams Login Pages

BlackSuit Ransomware Takedown Disables 9 Domains and 4 Servers, Seizes $1M

Kimsuky APT Hackers Exposed in Alleged Breach Revealing Phishing Tools and Operational Data

Carmaker Web Portal Exposes Remote Car Unlocking Vulnerability and Access to 1,000 Dealerships

Four Zero-Click DoS Flaws Abuse Windows RPC and LDAP to Launch Large-Scale DDoS via Domain Controllers

Qilin Ransomware Claims Formacompany & Co. Real Names Leak, Accuses the Offshore Company of Money Laundering

ClickFix PowerShell Attack Chain Leverages Email Invite Lures, Spoofed MS Teams Login Pages

BlackSuit Ransomware Takedown Disables 9 Domains and 4 Servers, Seizes $1M

Kimsuky APT Hackers Exposed in Alleged Breach Revealing Phishing Tools and Operational Data

Carmaker Web Portal Exposes Remote Car Unlocking Vulnerability and Access to 1,000 Dealerships

Four Zero-Click DoS Flaws Abuse Windows RPC and LDAP to Launch Large-Scale DDoS via Domain Controllers

Qilin Ransomware Claims Formacompany & Co. Real Names Leak, Accuses the Offshore Company of Money Laundering