International law enforcement authorities have seized the last clearnet domain of the notorious cybercrime marketplace, BreachForums. The domain, breachforums[.]hn, now has a seizure notice from the United States Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), as well as French authorities, including the Brigade de Lutte Contre la Cybercriminalité (BL2C) and the Parquet de Paris (JUNALCO).
This action marks another chapter in the ongoing battle to dismantle the persistent site data leak. The seizure notice confirms that the domain is under the control of authorities and provides contact information for individuals who wish to report information about the forum's criminal activities.
See also: New Quishing attack targets Microsoft users
The breachforums[.]hn domain was a relatively new home for the illegal forum, having been flagged as a new domain in August 2025. The site had also recently been used by the hacker group “Trinity of Chaos” or “Scattered Lapsus$ Hunters”—an alliance of the infamous groups Scattered Spider, Lapsus$, and ShinyHunters. The hackers had posted a “farewell letter” there announcing their supposed retirement from the cybercrime scene.
BreachForums: Multiple seizure attempts
BreachForums has a long and turbulent history, marked by numerous takedowns and rapid resurgences. The platform originally emerged as a successor to RaidForums, another hacking forum that was seized in early 2022.
See also: Phishing: Hackers impersonate HR departments to steal Gmail credentials
The original BreachForums was shut down in March 2023 following the arrest of its founder, Conor Brian Fitzpatrick, known as “Pompompurin.” Despite the arrest, the forum was quickly revived by other administrators. In May 2024, the FBI and international partners seized the site again, but it resurfaced within weeks under the control of the ShinyHunters. The forum has since operated on a number of different domains, continuing its role as a major marketplace for stolen databases, hacking tools, and other illicit goods.
Over the years, authorities have made several arrests linked to the forum's management, including four people in France in June 2025. However, the core operation has proven resilient, with new administrators and domains emerging after each outage.
See also: Hackers upgraded ClickFix attack with Cache Smuggling
This latest seizure follows a period of significant turmoil for the groups that run the forum. In August 2025, ShinyHunters issued a warning that BreachForums had been hacked and was acting as a decoy for authorities. The recent seizure of the .hn domain coincides with the apparent dissolution of the “Scattered Lapsus$ Hunters” alliance.
A corresponding Telegram channel used by the group descended into chaos, with members expressing confusion over the disappearance of key figure “Shiny” before an administrator locked the channel. While the clearnet site has gone down, some reports indicate that its dark web counterpart remains operational, suggesting that the battle against the cybercrime operation will likely continue.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
