Texas Border Business
U.S. Department of Justice
The Department of Justice announced today the seizure of the LeakBase database, one of the world’s largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools.
According to an affidavit unsealed on March 3, the LeakBase forum had over 142,000 members and more than 215,000 messages between members. Available on the open web and in English, the forum had an enormous and continuously updated archive of hacked databases including many from high profile attacks, including hundreds of millions of account credentials. LeakBase allowed forum users to sell the information from stolen databases, including data illegally obtained from U.S. corporations and individuals, and offered credit and debit card numbers, banking account and routing information, usernames and associated passwords which could facilitate additional account takeovers, as well as other sensitive business and personally identifiable information.
On March 3 and 4, law enforcement agents and officers in 14 countries including the United States took synchronized actions against LeakBase and its users in a coordinated effort hosted by Europol in The Hague. Specifically, the United States and other countries shut down LeakBase, seized its data and two of the domains used by the forum, posted seizure banners on the LeakBase sites, sent prevention messages to LeakBase members, and collected additional evidence. Law enforcement also executed search warrants, arrests, and conducted interviews in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.
“The takedown of this cyber forum disrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking and account credentials,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “This operation illustrates the strength of the United States and our international partners working across the globe to dismantle a critical cybercriminal forum. The Criminal Division will continue to leverage our international relationships to protect victim personal and account information from falling into the hands of transnational criminal organizations.”
“This 14-country operation demonstrates the extraordinary cooperation with our international partners,” said U.S. Attorney Melissa Holyoak of the District of Utah. “Working with our partners, we can take down even the most sophisticated cyber criminals and networks. My office remains steadfast in our commitment to investigate and seek justice for Americans who are targeted by individuals attempting to hide behind foreign borders.”
“The FBI, Europol, and law enforcement agencies from around the world executed a takedown of LeakBase, one of the largest online cybercriminal platforms, seizing users’ accounts, posts, credit details, private messages, and IP logs for evidentiary purposes,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Together with our partners, we are sending a message that no criminal is truly anonymous online and removing an easy point of access to stolen information on American businesses and individuals. The FBI will continue to defend the homeland by dismantling the key services that cybercriminals use to facilitate their attacks.”
“Hiding behind a screen does not shield cybercriminals from accountability,” said Special Agent in Charge Robert Bohls of the FBI Salt Lake City Field Office. “This international operation demonstrates the strength of our global alliances and our shared commitment to disrupting platforms that facilitate the theft of data and the victimization of innocent people and organizations worldwide. Together, we will continue to identify, dismantle, and hold accountable those who seek to profit from cybercrime, no matter where they operate.”
The announcement today follows the disruption of predecessor cybercrime marketplaces RaidForums in 2022 and BreachForums in 2023, in addition to the conviction and subsequent sentencing of the founder of BreachForums in 2025.
The FBI Salt Lake City Field Office is investigating the case. The FBI San Diego Field Office, Utah Department of Public Safety, and Provo Police Department also participated in the operation domestically.
Senior Counsel Matthew A. Lamberti of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorneys Brent L. Andrus and Carl D. LeSueur for the District of Utah are prosecuting the case. The Justice Department’s Office of International Affairs, Europol, and numerous law enforcement authorities in Australia, Belgium, Canada, Germany, Greece, Kosovo, Malaysia, Netherlands, Poland, Portugal, Romania, Spain, and the United Kingdom provided significant assistance.
CCIPS investigates and prosecutes cybercrime and intellectual property (IP) crime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals and IP criminals, and court orders for the return of over $350 million in victim funds.
Anyone that has any information regarding LeakBase should contact the FBI at FBI-SU-Leakbase@fbi.gov.
Updated March 4, 2026
