A major online marketplace for stolen data has been dismantled following a coordinated international operation led by Europol, authorities said Tuesday.
The forum, known as LeakBase, had become a central hub in the cybercrime ecosystem, specializing in the trade of leaked databases and “stealer logs”, archives of stolen login credentials harvested through infostealer malware.
Operating on the open web and in English, LeakBase combined elements of a marketplace and discussion board, enabling users to buy, sell and exchange compromised data. By December 2025, the platform had amassed more than 142,000 registered users, approximately 32,000 posts and over 215,000 private messages, underscoring its scale and global reach.
Between March 3 and 4, law enforcement agencies across multiple jurisdictions carried out coordinated enforcement actions, including arrests, house searches and so-called “knock-and-talk” interventions. Around 100 enforcement measures were conducted worldwide, targeting 37 of the platform’s most active users.
On March 4, authorities entered the technical disruption phase, seizing the forum’s domain and replacing it with a law enforcement notice.
The operation is now moving into a prevention phase aimed at deterring further criminal activity and raising awareness about the risks and consequences of engaging in cybercrime.
“This operation shows that no corner of the internet is beyond the reach of international law enforcement,” said Edvardas Šileris, head of Europol’s European Cybercrime Centre. “Those who believed they could hide behind anonymity are being identified and held accountable.”
Active since 2021, LeakBase maintained a large, continuously updated archive of breached databases, including both historic leaks and newly compromised data. The forum hosted vast quantities of credential pairs, such as email and password combinations, often used for account takeovers, fraud and further cyber intrusions.
A credit-based internal economy and reputation-driven user system helped foster trust among offenders and sustain activity on the platform. One internal rule reportedly prohibited the sale or publication of data related to Russia.
As part of the investigation, authorities seized the forum’s database, enabling investigators to deanonymize multiple users who believed they were operating under cover. Law enforcement officials have contacted several suspects directly through the same online channels previously used to facilitate criminal activity.
Analysts at Europol mapped the forum’s infrastructure and user activity, cross-referencing data with ongoing investigations across Europe and beyond. An operational data sprint at Europol headquarters in The Hague brought together specialists to analyze seized material and identify high-value targets.
The operation was carried out within the framework of the Joint Cybercrime Action Taskforce, hosted at Europol. On the day of action, a Joint Command Post coordinated real-time intelligence sharing among participating countries.
Authorities said investigations are ongoing as officers continue tracing digital trails to identify additional suspects and link online activity to real-world identities.
Officials also warned that stolen information from data breaches frequently resurfaces on criminal platforms like LeakBase, where it can be reused for scams, identity theft, account takeovers and phishing attacks.
They urged the public to use strong, unique passwords and enable multi-factor authentication to reduce the risks associated with data exposure.
add your comment
Terms of publication : Not to offend the writer, people, sacred things, or attack religions or the divine self, and refrain from racist incitement and insults.