Cybercrime: Authorities shut down the data leak forum LeakBase

Authorities from 14 countries, including Germany, have shut down the globally operating data leak forum LeakBase, seized its associated domains, and arrested several individuals. This was announced by the European police agency Europol, which led the operation. With over 142,000 members, the LeakBase database is considered one of the world's largest online forums for cybercriminals to buy and sell stolen data and tools for cyberattacks.

The English-language forum, active since 2021 and publicly accessible, contained a vast and constantly updated archive of stolen databases with hundreds of millions of credentials, according to investigators, and allowed users to sell information from these stolen databases. Offered were credit and debit card numbers, bank account details, usernames and associated passwords, sensitive business and personal data, some of which were obtained in high-profile cyberattacks.

“The dismantling of this online forum disrupts a key international platform that cybercriminals use to obtain and profit from sensitive personal data and bank and account information,” said Assistant Attorney General A. Tysen Duva of the U.S. Department of Justice's Criminal Division, which was also involved in the investigation.

Action in Numerous Countries

On March 3, law enforcement agencies reported conducting around one hundred coordinated measures in several countries, including targeting 37 of the platform's most active users. They executed search warrants, made arrests, and questioned individuals in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. Officials from Canada, Germany, Greece, Kosovo, Malaysia, and the Netherlands supported the investigation.

As part of the operation, authorities seized the forum's domain and database. This allowed for the de-anonymization of several users who believed they were operating anonymously, explained Europol in a statement. Law enforcement agencies were able to establish direct contact with several suspects through the same online channels used for criminal activities.

“This operation proves that no corner of the internet is safe from international law enforcement,” said Edvardas Šileris, Head of Europol's European Cybercrime Centre. “What began as a shady marketplace for stolen data has now been dismantled, and those who thought they were hidden behind anonymity will be identified and held accountable. This is a clear message to cybercriminals worldwide: those who trade in others' stolen data will be found by law enforcement and brought to justice.”

(akn)