Threats · 194 days ago
Europol, the FBI and international partners seized LeakBase — an open-web forum with ~142,000 users trading stolen credentials, stealer logs and financial data — and preserved accounts, posts, private messages and IP logs during 'Operation Leak' across 14 countries targeting 37 top users. Action: assume credential exposure—reset and monitor accounts, enforce MFA, hunt for suspicious logins and review transaction logs.
8 sources covering this story
LeakBase marketplace unplugged by cops in 14 countries
The action coordinated by Europol seized two of the group's domains and captured the forum's data, as well as making arrests.
FBI and Europol Seize LeakBase Forum Used to Trade Stolen Credentials
Authorities dismantled LeakBase, a cybercrime forum with 142,000 members trading stolen credentials and financial data in a global crackdown.
LeakBase Cybercrime Forum Shut Down, Suspects Arrested
The stolen credential marketplace had been active since 2021 and in late 2025 it counted 142,000 users.
Europol Operation Seizes LeakBase Data Breach Site
A global operation has resulted in the takedown of popular cybercrime forum LeakBase
LeakBase cybercrime forum with 142,000 users taken down in global operation - Help Net Security
LeakBase takedown follows an international law enforcement operation coordinated by Europol and involving authorities from 14 countries.
Authorities say LeakBase was "one of the world’s largest online forums for cybercriminals," and maintained an archive of hacked databases containing hundreds of millions of passwords.
Authorities from 14 countries shut down major cybercrime forum LeakBase
The marketplace was one of the world’s largest hubs for cybercrime with more than 142,000 members. Officials identified and arrested multiple suspects after seizing the site’s database.
The Record from Recorded Future
Sprawling FBI, European operation takes down Leakbase cybercriminal forum
The FBI and European law enforcement agencies carried out a global crackdown on a cybercrime forum where criminals bought and sold stolen credentials and exploits of software vulnerabilities.
Part of the PlainSec briefing for 2026-03-07