BreachForums crashes again after cybercrime group's takedown push
BreachForums, a notorious platform for trading leaked data, has once again been taken offline. The site went down over the weekend, displaying a 502 error to visitors. This latest disruption follows years of seizures, revivals, and growing distrust among its users.
The takedown was claimed by CCITIC, a nonprofit group focused on combating cybercrime. They filed abuse reports with DigitalOcean, the forum's hosting provider, which then shut down the servers. CCITIC also coordinated with authorities, though details remain undisclosed due to an ongoing investigation. Their goal was to send a warning to the broader underground scene about the risks of running criminal operations.
BreachForums has faced repeated crackdowns since 2022, yet it kept reappearing under new domains. After a major data leak in January 2023, the forum briefly resurfaced on Tor in March 2023 before being seized again in May 2024. By 2026, its activity had splintered across decentralised Telegram groups and private Discord servers. While the centralised structure weakened, a core of around 10,000 active leak traders remained.
Trust in the forum has plummeted since the 2023 data breach. Rumours spread that BreachForums was either a honeypot or had been infiltrated by insiders. Despite attempts to regroup—including a Telegram channel called BreachForums News—users have grown wary of its security.
The latest takedown leaves BreachForums offline for now. Its future remains uncertain as users scatter across smaller, harder-to-track platforms. CCITIC's action reinforces the ongoing pressure on cybercriminal networks, though the forum's persistent resurgence shows how difficult it is to shut them down for good.
