BreachForums

Profile narrative

BreachForums, also known as Breach Forums, is a cybercrime forum associated with underground online criminal activity. Its core function is to provide a forum-style platform where participants can communicate, publish posts, and exchange illicit cyber-related material. The services and content associated with the forum include stolen data, compromised account information, fraud methods, hacking tools, malware, and technical guidance for carrying out cyber intrusions or monetising access. Its market is not a legitimate consumer or enterprise market; it serves threat actors, fraud participants, and other users seeking criminal information, contacts, or digital goods. The United States is listed as the organisation’s HQ location in the supplied context, although the forum’s dark-web orientation means its operations are primarily associated with online criminal infrastructure rather than a conventional public-facing business presence.

The forum has had a notable footprint within cybercrime communities, but the available evidence should be treated carefully when interpreting scale. A June 2023 incident involved a rival threat actor hacking BreachForums and publishing a database covering 4,700 registered users, including usernames, email addresses, salted password data, and user activity records. A later incident dated August 2025 involved a leak of a database containing approximately 324,000 user records, with email addresses and IP addresses among the exposed fields. The same leak reportedly included a password-protected PGP private key file and a manifesto titled “Doomsday” authored under the name James. Analysts noted that many IP addresses were loopback addresses and that the database had limited forensic value, so the record count should not automatically be read as a precise count of unique, active criminal users. These incidents occurred after arrests and seizures involving administrators and after a law-enforcement takedown of the forum’s dark-web extortion site.

BreachForums is distinguished by its role as a gathering point for illicit cybercrime discussion and exchange rather than by any lawful product line or regulated service offering. Its positioning has been within the dark-web cybercrime ecosystem, and it became notable after former members resurrected the forum following the arrest of its original founder. Its operational history includes repeated disruption from both law-enforcement action and attacks by rival threat actors. The 2023 leak was described as legitimate and exposed user activity data, while the 2025 leak was reported to undermine trust in the platform and create opportunities for disinformation. No formal ownership, parent organisation, subsidiary structure, or conventional corporate hierarchy is stated in the provided material.

Incidents

3 incidents linked to this organisation.