International law enforcement agencies have dismantled the notorious cybercrime forum LeakBase, a marketplace used by hackers to trade stolen data, as part of a coordinated crackdown known as Operation Leak.
Authorities confirmed that the illegal platform—active since 2021—had grown into a major hub for cybercriminals, hosting more than 142,000 registered users by late 2025.
International Operation Targets Cybercrime Network
The operation was coordinated with support from Europol and involved law enforcement agencies from North America, Europe, and the Asia-Pacific region.
Investigators successfully shut down two domains used by the forum and seized the platform’s database. The confiscated data allowed authorities to identify numerous individuals connected to the cybercrime marketplace.
Law enforcement officials reported that the database contained:
- Approximately 215,000 private messages
- More than 32,000 forum posts
- User account records and IP address logs
The seized information is expected to assist investigators in tracking down additional suspects linked to the platform.
Marketplace for Stolen Credentials and Personal Data
LeakBase operated as an underground forum where cybercriminals bought and sold large volumes of stolen information. The marketplace offered access to various types of compromised data, including:
- Online account credentials
- Personally identifiable information (PII)
- Payment card details
- Bank account data
The forum relied on a credit-based system and reputation rankings to build trust among its members, allowing sellers with verified transactions to gain credibility in the criminal community.
According to investigators, this model helped LeakBase grow into a thriving cybercrime ecosystem.
Dozens of Suspects Targeted
Authorities confirmed that 37 of the forum’s most active users were targeted during Operation Leak. Measures included arrests, house searches, and direct law enforcement visits to suspects.
Officials have not yet disclosed the identities or nationalities of those detained, but investigations are ongoing.
Possible Russian Links to Forum Operations
Investigators also uncovered internal rules within the forum that raised questions about the origin of its operators.
One rule explicitly banned the sale or publication of stolen data related to Russia, suggesting possible ties between the forum’s administrators and Russian cybercrime networks.
While authorities have not officially confirmed the operators’ location, experts say such rules are common in underground forums run from jurisdictions where local victims are avoided to reduce law enforcement pressure.
Wider Cybercrime Takedown Efforts
The shutdown of LeakBase was announced on the same day that Microsoft, along with Europol and several cybersecurity firms, revealed the dismantling of the Tycoon 2FA phishing platform, another major cybercrime service used to steal login credentials.
These coordinated actions highlight the increasing cooperation between international law enforcement agencies and technology companies to combat global cybercrime networks.
Security experts say such operations are critical in disrupting online criminal marketplaces, although similar platforms often reappear under new names.
