The U.S. Department of Justice announced the successful dismantling of LeakBase, a massive cybercrime forum and marketplace used to buy and sell stolen data. The disruption was the result of a multi-year investigation known as “Operation Leak,” led by the FBI’s Salt Lake City Field Office and coordinated internationally by Europol. 

Scope of the Seizure

The operation resulted in the seizure of the forum’s entire backend infrastructure and the collection of data belonging to its 142,000 members. 

• Database Capture: Law enforcement seized the forum’s database, including 215,000 private messages, IP logs, and user account details, which are now being used for further investigations.
• Domain Takedowns: Two primary domains (including leakbase[.]la) were seized and replaced with seizure banners warning members that their information is now in the hands of authorities.
• Content Removed: The forum hosted an archive of hundreds of millions of credentials, credit card numbers, and banking details stolen from high-profile attacks on U.S. and international corporations. 

Global Law Enforcement Action

The synchronized crackdown involved agencies from 14 countries, including Australia, Belgium, Germany, Poland, Portugal, Romania, Spain, and the United Kingdom. 

• Arrests and Raids: The operation included 13 arrests, 32 searches, and interviews with 33 additional suspects across multiple continents.
• Infrastructure Disruption: Hosting infrastructure used by the forum was shut down in locations ranging from the Netherlands to Malaysia.
• Targeting Users: In addition to administrators, authorities conducted approximately 100 enforcement actions against some of the platform’s most active users. 

Significance of the Takedown

Active since 2021, LeakBase grew significantly after the closure of preceding forums like BreachForums and RaidForums. It operated on a subscription model, charging users for “premium” access to leaked databases. According to the FBI, the forum had become a priority due to the increasing exchange of information targeting U.S. critical infrastructure.