BreachForums Reboot Emerges Under Suspect Admin as 918 Stolen Databases Leak
A new BreachForums reboot appeared online with an administrator using the handle "X", who claimed the forum had been rebuilt after its infrastructure, database, and source code were hacked from a hosting server and the prior operator "N/A" abandoned the project. The alleged revival was quickly disputed: ShinyHunters publicly denied any role in the new site and said it had not operated BreachForums since the FBI seizure in October 2025. Researchers also pointed to inconsistencies in X's account, raising doubts about whether the latest site is a legitimate successor, a copycat operation, or a setup using leaked forum data.
The confusion comes amid a broader compromise tied to the BreachForums ecosystem, including the leak on Telegram of 918 databases previously sold through the forum. Reporting said the exposed trove contains personal and sensitive data from numerous historical breaches, creating renewed opportunities for phishing, ransomware, and espionage. Multiple BreachForums-branded sites are now online, complicating attribution and increasing the possibility that some may be impersonation efforts, criminal competition, or potential law enforcement honeypots following repeated takedowns of major cybercrime forums.
Timeline
Apr 3, 2026
Researchers question legitimacy of the new BreachForums site
Reporting and researcher analysis identified inconsistencies in X's account and suggested the reboot may rely on leaked data or otherwise be illegitimate. Multiple BreachForums-branded sites appearing online further complicated attribution and raised possibilities including copycats or law enforcement honeypots.
Apr 3, 2026
ShinyHunters denies involvement in latest BreachForums revival
After the new site appeared, ShinyHunters publicly denied any role in reviving BreachForums and said it had not run the forum since the October 2025 FBI seizure. The denial undermined claims that the reboot was an authentic continuation of the prior forum.
Apr 1, 2026
BreachForums reboot appears under new admin "X"
In early April 2026, a new BreachForums-branded site surfaced with an administrator calling themselves "X." X claimed the forum had been rebuilt after the prior infrastructure, database, and source code were hacked from its hosting server and the previous admin "N/A" abandoned the project.
Mar 1, 2026
918 previously sold BreachForums databases leak on Telegram
In March 2026, 918 databases previously sold through BreachForums were leaked on Telegram, exposing centralized access to historical stolen data from many organizations. Researchers warned the leak could enable phishing, ransomware, and espionage.
Oct 10, 2025
FBI seizes BreachForums infrastructure
ShinyHunters said it had not operated BreachForums since the FBI seizure of the forum on October 10, 2025. This seizure became the reference point for later disputes over who controlled subsequent BreachForums-branded sites.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Threat Actors
Sources
Related Stories
ShinyHunters Leaks 300,000 BreachForums User Records After Exiting Forum
ShinyHunters said it has abandoned **BreachForums** and released an updated database affecting more than **300,000 users** of the cybercrime marketplace. Reports say the leak goes beyond basic credentials and includes full account profile and activity data, including usernames, email addresses, hashed passwords, salts, IP addresses, login metadata, and forum activity timestamps. The group said maintaining the forum ecosystem became a "waste of time" after the FBI seizure of BreachForums and claimed that all currently active BreachForums domains are fake. ShinyHunters also threatened to publish fuller backups — including private messages, posts, and additional user data — unless the remaining forums shut down, while asserting it holds exploits for all **MyBB 1.8** versions; the identity of the operators behind current BreachForums instances remains unclear, with speculation ranging from opportunistic criminals to possible law enforcement honeypots.
3 days ago
BreachForums Data Breach and Dark Web Data Leaks
A major data breach has exposed the entire user database of BreachForums, a prominent English-language hacking forum on the dark web. The breach was announced on the shinyhunte[.]rs platform, which published a message and made the leaked database available for download and analysis. BreachForums, which had previously replaced RaidForums after its seizure, has been a central hub for cybercriminal activity, including the distribution of stolen data and hacking tools. The forum has faced multiple shutdowns and seizures, but continued to operate under new management and through various hosting providers and domains. In addition to the BreachForums breach, recent activity on dark web forums has included the sale and sharing of data from a South Korean university and a Saudi Arabian employment platform. These incidents highlight the ongoing risks posed by data leaks and breaches on dark web marketplaces, where sensitive information is traded and discussed. Security researchers have made related indicators of compromise (IOCs) and analysis available to subscribers, emphasizing the need for vigilance among organizations whose data may be exposed in such forums.
1 months ago
Law Enforcement Seizure of BreachForums Used for Salesforce Extortion
U.S. and French law enforcement agencies, including the FBI and France’s BL2C cybercrime unit, have seized the primary domains of BreachForums, a notorious hacking forum operated by the ShinyHunters group. The forum, previously known for facilitating cybercriminal activity, had recently shifted its focus from a traditional discussion platform to a dedicated leak and extortion portal. This portal was being used to publish and threaten the release of data stolen from Salesforce and its corporate customers as part of an ongoing extortion campaign. High-profile companies such as Qantas, Disney, McDonald’s, and UPS were among the reported victims of this campaign, which relied heavily on social engineering tactics to compromise Salesforce accounts. The seizure notice, now displayed on the forum’s clearnet domain, features the logos of U.S. and French authorities, signaling the international cooperation behind the takedown. Despite the seizure of the clearnet site, the group’s onion (dark web) domain remains operational, continuing to threaten the release of stolen data. ShinyHunters, under the new moniker Scattered Lapsus$ Hunters, confirmed the loss of their infrastructure in a PGP-signed statement, acknowledging that all their domains and backend servers had been taken by law enforcement. They also admitted that database archives and escrow data dating back to 2023 are now under FBI control, effectively compromising years of criminal records and transactions. The group stated that no core administrators had been arrested, but they would not attempt to relaunch BreachForums, warning that such forums are now likely to be law enforcement honeypots. The seizure was timed to prevent the public release of sensitive Salesforce customer data, which the group had threatened to leak at a specified deadline. Law enforcement’s action represents a significant disruption to the infrastructure supporting ransomware and extortion operations targeting major corporations. The operation also highlights the ongoing evolution of cybercriminal tactics, as forums transition from discussion boards to direct extortion platforms. Despite the takedown, the threat actors insist that their Salesforce campaign remains unaffected, and their dark web leak site continues to list affected companies. The incident underscores the persistent threat posed by groups like ShinyHunters and the challenges faced by law enforcement in fully dismantling their operations. The seizure of BreachForums is the latest in a series of law enforcement actions targeting cybercrime forums, following previous takedowns such as RaidForums. The event demonstrates the importance of international collaboration in combating cyber-enabled extortion and data theft. Organizations affected by the Salesforce campaign are advised to monitor for potential data leaks and strengthen their security posture against social engineering attacks. The broader cybersecurity community is watching closely to see if the disruption of BreachForums will have a lasting impact on the underground economy or simply drive activity further underground.
1 months ago