BreachForums
 | |
Type of site | Internet forum |
|---|---|
| Available in | English |
| Predecessor | RaidForums |
| Country of origin | United States |
| Founder(s) | Conor Brian Fitzpatrick, also known by his screen name "pompompurin" |
| URL | breachforums.st /.cx/.is/.vc |
| Advertising | Yes |
| Commercial | Yes |
| Users | Approximately 324,000 in August 2025[1] |
| Launched | March 4, 2022 |
| Current status | Offline |
BreachForums, sometimes referred to as Breached, was an English-language black-hat hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizure in 2022.[2] Like its predecessor, BreachForums allowed discussions concerning hacking and facilitated the distribution of data obtained through data breaches, hacking tools and various other services.
On March 21, 2023, BreachForums was shut down following the arrest of its owner, Conor Brian Fitzpatrick.[3] The forum was later reopened under the administration of the hacking group ShinyHunters and former BreachForums administrator "Baphomet". Fitzpatrick was initially sentenced to time served followed by 20 years of supervised release. The site was again shut down and its domains seized on May 15, 2024, before returning online later that month.
BreachForums, along with other cybercrime forums, used DDoS-Guard for web-hosting services.[4] DDoS-Guard has been criticized for hosting websites associated with illicit activities and for its alleged lack of action in response to abuse reports.[5]
History
[edit]The forum was founded in March 2022 by then-19-year-old Conor Brian Fitzpatrick, known on the forum by the screen name "pompompurin".[6] His username was based on the Japanese character Pompompurin by Sanrio. A year earlier, Fitzpatrick had claimed responsibility for the 2021 FBI email hack.[7]
Following Fitzpatrick's arrest, control of the forum was transferred to Baphomet and ShinyHunters. In 2024, the user IntelBroker became the forum's new owner after the platform had reportedly stagnated under its previous administration.[8] In 2025, IntelBroker announced that he was stepping down as administrator and transferring ownership to an account named "Anastasia".
ShinyHunters later stated that IntelBroker had acted as a figurehead and returned to publicly operating the website. ShinyHunters also claimed that "Anastasia" was an alternate account operated by the group.[citation needed]
In April 2025, the administrators shut down BreachForums, citing an alleged zero-day vulnerability in MyBB, the software on which the forum operated.[9]
In August 2025, BreachForums went offline again after ShinyHunters claimed that the website had been compromised and was being controlled by international law-enforcement agencies.[10]
In April 2026, ShinyHunters published a message on its data-leak website stating that no official version of BreachForums existed.[citation needed]
Notable leaks
[edit]On December 10, 2022, a forum member using the screen name "USDoD" posted a thread offering to sell a database containing information concerning more than 80,000 members of the FBI nonprofit organization and information portal InfraGard. The individual claimed to have accessed the portal through a social-engineering attack in which they impersonated the chief executive of an unidentified American financial corporation.[11]
On March 6, 2023, IntelBroker posted that he was selling data originating from the breach of DC Health Link, a Washington, D.C., health insurance marketplace. On March 9, another member using the screen name "Denfur" posted a thread containing 200 entries and claimed that additional information would be released. The D.C. Health Benefit Exchange Authority later stated that more than 56,000 customers had been affected, while the original forum posts claimed to contain information concerning more than 170,000 customers.[12][13]
On July 23, 2024, the entire database of the original BreachForums was leaked online by a threat actor. The site's founder, Fitzpatrick, allegedly attempted to sell the data after being indicted and while released on bail.[14]
Arrests and shutdowns
[edit]On March 15, 2023, Fitzpatrick was arrested in Peekskill, New York, and charged in federal court with conspiracy to commit access-device fraud.[15][6][16]
Following Fitzpatrick's arrest, another administrator using the screen name "Baphomet" took control of the website and its infrastructure. Baphomet shut it down on March 21, 2023, after expressing concerns that its infrastructure had been compromised.[17] Baphomet later reopened the forum with ShinyHunters.[18]
Approximately one month after his arrest, Fitzpatrick was hospitalized following an apparent suicide attempt while released on bail.[19]
He later pleaded guilty to conspiracy to commit access-device fraud, access-device fraud and possession of child sexual abuse material.[20]
In January 2024, Fitzpatrick was detained after violating bail conditions that prohibited him from using a virtual private network.[21]
Despite federal prosecutors requesting a prison sentence of more than 15 years, Fitzpatrick was initially sentenced to time served followed by 20 years of supervised release.[22]
First domain seizure
[edit]
On June 23, 2023, three months after the forum's shutdown, its clearnet domains were seized by the Federal Bureau of Investigation, the Office of Inspector General of the United States Department of Health and Human Services, and the United States Department of Justice. The seizure was conducted under a warrant issued by the United States District Court for the Eastern District of Virginia.
Second domain seizure
[edit]
On May 15, 2024, the FBI seized BreachForums' clearnet website, its .onion service and an associated Telegram channel. The seizure followed the publication of data obtained from Europol's portal. According to ShinyHunters, the forum administrator Baphomet was also arrested.[23] The website returned online on May 29, 2024.[24]
2025 suspected MyBB zero-day infiltration
[edit]On April 28, 2025, BreachForums administrators published a PGP-signed statement on the forum's landing page, stating that they had taken the website offline earlier that month after trusted contacts allegedly confirmed that law-enforcement agencies had exploited an undisclosed zero-day vulnerability in MyBB to gain covert access.[25][26][27]
The administrators stated that an incident-response review had found no evidence of a data compromise, but that the forum would remain offline while its back end was rewritten. They also warned that recently launched BreachForums clones were likely honeypots and reiterated that no staff members had been arrested.[25][26]
2025 arrests
[edit]In February 2025, a suspected BreachForums administrator known as IntelBroker was arrested.[28]
In June 2025, French police announced the arrests of four other suspected BreachForums administrators: Hollow, Noct, Depressed and ShinyHunters.[28] All four were reported to be in their twenties. The FBI's Internet Crime Complaint Center stated that ShinyHunters had operated the website from June 2023 until its shutdown.[28]
At the end of July 2025, two news websites suggested that French authorities may have arrested an affiliate of ShinyHunters rather than the group's principal operator, as the ShinyHunters identity appeared to remain active.[29][30]
2025 shutdown
[edit]On August 12, 2025, BreachForums went offline after ShinyHunters claimed that the website had been compromised and was controlled by international law-enforcement agencies.[10]
In a PGP-signed message published on Telegram, ShinyHunters alleged that the forum's infrastructure and official PGP key were in the possession of the French police's cybercrime unit, operating in cooperation with the United States Department of Justice and the FBI. The statement alleged that administrator accounts belonging to Hollow, ShinyHunters and the account known as "Founder" had been seized.[citation needed]
The message further claimed that private messages, plaintext passwords, IP addresses, email addresses and other metadata collected since the forum's July 1 relaunch had been exposed. ShinyHunters also alleged that the forum's source code had been modified to record user activity, effectively converting it into a honeypot intended to identify participants.[citation needed]
Founder's resentencing in 2025
[edit]On September 16, 2025, Fitzpatrick was resentenced to three years in federal prison.[31]
The resentencing followed a January 2025 decision by the United States Court of Appeals for the Fourth Circuit, which vacated his initial sentence of 17 days of time served and 20 years of supervised release. The appeals court found the original sentence substantively unreasonable in light of the scale and seriousness of the offenses.[32]
As part of his plea agreement, Fitzpatrick forfeited more than 100 domain names, more than a dozen electronic devices and cryptocurrency derived from the forum's activities. According to the Department of Justice, the original BreachForums hosted more than 14 billion individual records of personal information.[31]
Competing successor forums (2025–2026)
[edit]Following the shutdown of a previous version of BreachForums in 2025, several competing platforms claimed to be continuations of the forum. SpyCloud described the resulting rivalry as the "Forum Wars" or "Clone Wars", while ZATAZ characterized the later history of BreachForums as a permanent war of succession in which the authenticity and lineage of the different versions became increasingly difficult to establish.[33][34]
According to SpyCloud, one of these versions was successively accessible through several domain names and was reportedly associated with former members of the BreachForums staff. The company stated that an actor using the pseudonym N/A appeared to have controlled Indra's account while one version of the website operated under the breachforums[.]as domain. N/A was also reported to have controlled older accounts belonging to former administrators or community members, including Caine. SpyCloud nevertheless emphasized that it was unclear who had controlled the different Indra accounts during the dispute.[35] ZATAZ similarly considered the forum's historical continuity to have become disputed beginning with the versions it classified as BF V4.[34]
Following Indra's withdrawal from the administration, under circumstances that were reported inconsistently, an actor using the pseudonym Breach3d reportedly helped maintain the continuity of BreachForums. Breach3d was described as the owner and one of the principal administrators of platforms operating through the breachforums[.]ac and breached[.]rs domains, which he allegedly operated alongside an associate.[citation needed]
The breach3d account was also reported to have been active on versions of BreachForums from December 2025, primarily publishing databases relating to France and several other countries.[citation needed] In April 2026, the pseudonym was associated with a claim of responsibility for a data breach affecting the French Agence nationale des titres sécurisés, also known as France Titres. A 15-year-old suspected by investigators of using the pseudonym was detained on April 25, 2026.[36]
2026 data breach
[edit]In January 2026, user data from the website was leaked alongside a manifesto by an actor using the alias "James".[1] The most recent registration date in the leaked database was August 11, 2025, suggesting that the data had been obtained shortly before the August 2025 closure. The leak included information concerning approximately 324,000 user accounts.[1]
See also
[edit]References
[edit]- 1 2 3 Kunert, Paul (January 12, 2026). "Infamous BreachForums forum breached, spilling data on 325K users". The Register. Retrieved January 15, 2026.
- ↑ "Justice Department Announces Arrest of the Founder of One of the World's Largest Hacker Forums and Disruption of Forum's Operation". United States Department of Justice. Archived from the original on March 28, 2023. Retrieved March 28, 2023.
- ↑ "BreachForums down, and will not be back". DataBreaches.net. June 14, 2023 [March 21, 2023]. Archived from the original on June 18, 2023. Retrieved June 18, 2023.
- ↑ "Developing: BreachForums down, ShinyHunters' and forum Telegram channels deleted?". DataBreaches.Net. June 10, 2024. Retrieved September 18, 2024.
- ↑ Kolomychenko, Maria (January 29, 2021). Igumenov, Valery (ed.). "'Remove this infection from your network': The small Russian company that 'saved' Parler has other, far more odious clients". Meduza. Translated by Kevin Rothrock. Retrieved February 9, 2021.
- 1 2 Lakshmanan, Ravie. "20-Year-Old BreachForums Founder Faces Up to 5 Years in Prison". The Hacker News. Archived from the original on April 2, 2023. Retrieved April 2, 2023.
- ↑ Podkul, Cezary (January 25, 2022). "Despite Decades of Hacking Attacks, Companies Leave Vast Amounts of Sensitive Data Unprotected". ProPublica. Archived from the original on June 1, 2023. Retrieved April 2, 2023.
- ↑ Melillo, Pietro (August 22, 2024). "IntelBroker Takes Control of BreachForums: A New Chapter in Cybercrime Management". RedHotCyber. Retrieved August 29, 2024.
- ↑ "BreachForums Displays Message About Shutdown, Cites MyBB 0day Flaw". HackRead. April 28, 2025. Retrieved September 8, 2025.
- 1 2 Ćemanović, Amar (August 12, 2025). "BreachForums Relaunch Shuts Down Amid Claims of Law Enforcement Takeover". CyberInsider. Retrieved September 8, 2025.
- ↑ Krebs, Brian. "FBI's Vetted Info Sharing Network 'InfraGard' Hacked". KrebsOnSecurity. Archived from the original on April 2, 2023. Retrieved April 2, 2023.
- ↑ Vicens, AJ. "Hacker tied to D.C. Health Link breach says attack 'born out of Russian patriotism'". CyberScoop. Archived from the original on May 8, 2023. Retrieved April 2, 2023.
- ↑ Bajak, Frank. "Congress members warned of significant health data breach". AP News. Associated Press. Archived from the original on April 7, 2023. Retrieved April 2, 2023.
- ↑ "BreachForums v1 hacking forum data leak exposes members' info". BleepingComputer. Retrieved July 25, 2024.
- ↑ "FBI arrests alleged cybercriminal in Peekskill". March 19, 2023. Retrieved April 2, 2023.
- ↑ "United States v. Fitzpatrick" (PDF). CourtListener. United States District Court for the Eastern District of Virginia. p. 29. Archived (PDF) from the original on April 12, 2023. Retrieved April 2, 2023.
- ↑ Arntz, Pieter. "BreachForums to be shut down after all for fear of law enforcement infiltration". Malwarebytes. Archived from the original on May 13, 2023. Retrieved April 2, 2023.
- ↑ "BreachForums – Official FBI Seizure Notice". November 20, 2024. Retrieved November 20, 2024.
- ↑ Clarkin, Regina (April 28, 2023). "Accused Peekskill Cybercriminal Hospitalized Wednesday". Peekskill Herald. Archived from the original on March 18, 2024. Retrieved October 28, 2023.
- ↑ "Owner of BreachForums pleads guilty in federal court to three counts, including one involving child pornography". July 14, 2023. Archived from the original on January 20, 2024. Retrieved October 28, 2023.
- ↑ Jones, Connor. "BreachForums admin jailed for flouting pretrial rules". The Register. Archived from the original on March 7, 2024. Retrieved February 16, 2024.
- ↑ "BreachForums hacking forum admin sentenced to 20 years supervised release". BleepingComputer. Archived from the original on March 17, 2024. Retrieved February 16, 2024.
- ↑ "FBI seize BreachForums hacking forum used to leak stolen data". BleepingComputer. Archived from the original on May 15, 2024. Retrieved May 15, 2024.
- ↑ "Leak Site BreachForums Springs Back to Life Weeks After FBI Takedown". Dark Reading. Retrieved June 25, 2024.
- 1 2 "BreachForums Displays Message About Shutdown, Cites MyBB 0-Day Flaw". HackRead. April 28, 2025. Retrieved April 28, 2025.
- 1 2 "BreachForums Reveals Law Enforcement Crackdown Exploiting MyBB 0-Day Vulnerability". Cyber Security News. April 28, 2025. Retrieved April 28, 2025.
- ↑ "BreachForums compromised in zero-day attack on "unpatched" software, new admin says". Cybernews. April 28, 2025. Retrieved April 28, 2025.
- 1 2 3 Jones, Connor (June 25, 2025). "French cybercrime police arrest five suspected BreachForums admins". The Register. Retrieved June 28, 2025.
- ↑ "Are Scattered Spider and ShinyHunters one group or two? And who did France arrest? (1)". DataBreaches.Net. August 3, 2025. Retrieved September 7, 2025.
- ↑ Abrams, Lawrence (July 30, 2025). "ShinyHunters behind Salesforce data theft attacks at Qantas, Allianz Life, and LVMH". BleepingComputer. Retrieved September 8, 2025.
- 1 2 "Founder of One of World's Largest Hacker Forums Resentenced to Three Years in Prison". United States Department of Justice. September 16, 2025. Retrieved July 31, 2026.
- ↑ United States v. Fitzpatrick (United States Court of Appeals for the Fourth Circuit January 21, 2025), Text.
- ↑ "January Cybercrime Update: OpenClaw Chaos, Clone Wars and More". SpyCloud. Retrieved July 31, 2026.
- 1 2 Bancal, Damien (March 27, 2026). "BreachForums, chronique d'une succession toxique". ZATAZ (in French). Retrieved July 31, 2026.
- ↑ "March Cybercrime Update: RATs, Ransomware and Arrests". SpyCloud. March 31, 2026. Retrieved July 31, 2026.
- ↑ Jones, Connor (April 30, 2026). "French prosecutors link 15-year-old to mega-breach at state's secure document agency". The Register. Retrieved July 31, 2026.