Cyber Threat Actor: LeakBase

LeakBase is the primary alias used by a threat actor that has been observed distributing stolen data on underground forums and file‑hosting services. Open‑source reporting indicates that the actor is based in Russia, although no further details about its organizational structure or leadership are publicly available. The name appears in multiple breach notifications where the actor claims responsibility for exfiltrating datasets and making them accessible for download.

The actor’s observed activity focuses on government and public‑sector platforms, as evidenced by the compromise of the Penang government website in Malaysia and the Swachhata Platform operated by India’s Ministry of Housing and Urban Affairs. In both cases the stolen material consisted of personally identifiable information such as email addresses, hashed passwords and user identifiers, which was subsequently shared via BreachForums or a file‑hosting site. According to analyses from security researchers, participants associated with LeakBase typically seek financial gain by selling access to compromised admin panels and servers of content management systems, and they often aggregate stolen data for resale as leads on cybercrime markets. The reported tactics involve data exfiltration followed by distribution through forums and file‑hosting platforms, with no specific malware families, initial‑access vectors or tooling styles described in the sources.

No public attribution links LeakBase to a state‑sponsored program or a known criminal consortium; the actor is characterized solely as a data‑broker group that provides leaked information and illicit access for profit. Representative operations include the January 2023 leak of over 600 000 rows of private data from the Penang government’s official website and the September 2022 exposure of approximately 16 million user records from India’s Swachhata Platform. These incidents illustrate the actor’s pattern of targeting governmental services, extracting personal data, and monetizing the material, extracting PII, and offering the resulting datasets for download or sale on cybercrime venues. The available information does not support statements about the actor’s size, sophistication, revenue or broader geopolitical motives beyond the financially oriented behavior described in the cited reports.