An international law enforcement operation has dismantled LeakBase, a major online marketplace for stolen data that had become a central hub for cybercriminal activity. The forum had more than 142,000 registered users and hosted thousands of posts offering exposed databases and stolen credentials.
The operation, coordinated by Europol, targeted the platform’s infrastructure as well as several of its most active users. Investigators carried out coordinated law enforcement actions between March 3 and 4, marking one of the latest global efforts to disrupt the underground economy that thrives on stolen personal and corporate data.
Authorities say the operation to dismantle the cybercrime forum significantly disrupted a platform that had been widely used by criminals to exchange compromised information and facilitate further cyberattacks.
LeakBase: A Growing Marketplace for Stolen Credentials
Active since 2021, LeakBase operated openly online and primarily used the English language, which allowed it to attract a global community of cybercriminals . The forum specialized in the exchange of database leaks and so-called “ stealer logs ,” which are collections of credentials captured by infostealer malware . These logs typically contain email addresses, passwords , and other identifying data that criminals use to gain access to online accounts. Once obtained, the information can be used for account takeovers, fraud, and further cyber intrusions .
See also: Operation Red Card 2.0: 651 arrests for online fraud in Africa
Over time, LeakBase developed a structured system that helped it grow rapidly. The forum used a credit-based economy and reputation system, allowing users to build credibility within the community and gain access to more valuable data. This system helped maintain trust among leakers and kept the market active.
Despite being an international platform, LeakBase reportedly had an internal rule prohibiting the sale or publication of Russia-related data, highlighting the unusual dynamics that sometimes exist within cybercriminal networks.
By December 2025, the forum had amassed more than 142,000 registered users, approximately 32,000 posts, and over 215,000 private messages.
Coordinated Global Action Against Cybercrime Forum
The operation to dismantle the cybercrime forum involved law enforcement from multiple countries, including Australia, Belgium, Canada, Germany, Greece, Malaysia, the Netherlands, Poland, Portugal, Romania, Spain, the United Kingdom, and the United States.
On March 3, authorities launched coordinated law enforcement actions that included arrests, house searches, and “knock-and-talk” visits targeting suspicious individuals.
Around 100 law enforcement actions were carried out worldwide, with investigators focusing on 37 of the platform's most active users.
See also: Poland: Arrest of man linked to Phobos ransomware
The next day, authorities moved into the technical disruption phase of the operation. Investigators seized the forum's domain and replaced the website with a seizure notice, effectively shutting down the platform and preventing further activity.
Officials say the investigation is now entering a prevention phase aimed at deterring others from engaging in similar cybercriminal activities.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Europol's Role in Monitoring the Forum
Europol analysts played a key role in the investigation by mapping the LeakBase forum infrastructure and analyzing user activity across the platform.
Researchers cross-referenced the forum data with ongoing cases across Europe and other regions, helping to identify suspects and connect digital evidence.
At Europol headquarters in The Hague, experts were gathered to quickly process the seized information.
The operation was carried out within the framework of the Joint Cybercrime Action Team (J-CAT), which supports international cybercrime investigations.
Authorities say the investigation revealed how fragile anonymity can be in the world of cybercrime. By combing through the forum's database, investigators were able to identify and expose several users who they believed were operating in complete anonymity.
See also: OnlyFake: Ukrainian confessed to selling fake AI identities
In some cases, investigators contacted suspects directly through the same online channels that had been used to facilitate criminal activity.
Edvardas Šileris, head of Europol's European Cybercrime Centre, said the operation sends a clear message to cybercriminals operating online.
“This operation shows that no part of the internet is beyond the reach of international law enforcement. What began as a dark forum for stolen data has now been dismantled, and those who thought they could hide behind anonymity are being identified and held accountable. This is a clear message to all cybercriminals: if you are trading in the stolen information of others, law enforcement will find you and bring you to justice“.
