BreachForums

Summary

The notorious hacking forum BreachForums suffered a leak exposing a database of over 320 000 user records that included email addresses, IP information, a PGP private key and a lengthy manifesto. The leak followed a pattern of law‑enforcement actions that had already led to the arrest of its founder, the seizure of its domains and the detention of several alleged administrators. Analysts noted that the disclosed data is of interest to investigators but warned that it could be used to spread disinformation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 9 2026 a zip archive containing a MySQL database of 323 986 BreachForums users appeared on the domain shinyhunte[.]rs. According to Have I Been Pwned the breach occurred in August 2025, and the database bears an August 11 timestamp that coincided with the forum’s administrators announcing a shutdown due to fears of law‑enforcement compromise. The leaked archive included a password‑protected PGP private key file and a 4 400‑word manifesto titled “Doomsday” authored by someone using the name “James” who claimed responsibility for the leak. The PGP key was subsequently posted on January 10 and was identified by Resecurity as likely used to sign messages from BreachForums administrators.

BreachForums originated as the successor to RaidForums, which was seized by United States authorities in 2022. In 2023 the site’s alleged founder and administrator, Conor Brian Fitzpatrick, was arrested; its clearnet domains were seized three months later and he was later sentenced to three years in prison. The following year, a replacement administrator known as Baphomet was reportedly arrested. In 2025 five additional individuals accused of involvement with the forum were taken into custody, and in October of that year law enforcement executed a takedown of the BreachForums dark‑web extortion site.

The exposed database contains email addresses and IP address information; many of the IP addresses are loopback addresses, while the most commonly used email service for registration was Gmail. Resecurity’s analysis highlighted the presence of the PGP key and the manifesto as novel components of the January leak. Have I Been Pwned recorded the breach in its database, noting the timing and scope of the exposed user data.

Sources

Sources available to members: 1 source.