Following a significant global law enforcement crackdown coordinated by Europol, one of the world’s largest online forums specializing in traded stolen data, known as LeakBase, has been shut down. This English-language site, which operated openly on the surface web, served as a marketplace for various forms of stolen information, including logs from infostealer malware—tools specifically designed to harvest credentials and other sensitive data from unsuspecting users.
As of December 2025, LeakBase boasted over 142,000 registered users, with an impressive record of around 32,000 posts and more than 215,000 private messages exchanged among users. The forum represented a substantial online ecosystem through which illicit activities surrounding stolen data thrived. The coordinated law enforcement action that occurred on March 3 included a series of arrests and house searches across multiple countries, including the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. During this operation, law enforcement agencies targeted 37 of the forum’s most active users while also pursuing many others involved in the site’s operations.
In a decisive follow-up to the arrests, authorities seized two domains associated with LeakBase, promptly replacing the homepage with a law enforcement notice that announced the commencement of “Operation Leak.” This strategic move not only highlighted the successful operation but also served as a public warning against similar illicit endeavors.
As part of this extensive investigation, the law enforcement agencies collected LeakBase’s customer database, which could potentially yield further leads in identifying users who participated in the forum’s criminal activities. “This operation shows that no corner of the internet is beyond the reach of international law enforcement,” remarked Edvardas Šileris, who heads Europol’s European Cybercrime Centre. His statement underscored the determination of authorities to dismantle these shadowy platforms and bring their operators to justice. He further emphasized that individuals who believe they can navigate anonymity on the internet without repercussions would soon find that they are being tracked and identified.
Operation Leak comes as a part of a broader campaign aimed at disrupting a robust trade in stolen data, primarily driven by rampant infostealer activities. In fact, a report from the previous year indicated that a staggering 1.8 billion credentials had been stolen during the first half of 2025—a figure reflecting an 800% increase compared to the previous six months. This alarming trend illustrates the burgeoning market for stolen data and highlights the urgent need for law enforcement to take decisive and coordinated action against cybercriminals.
Interestingly, LeakBase is not the first forum of this nature to be targeted by law enforcement. Similar operations have successfully dismantled other platforms in recent years, including RaidForums, which was taken down in 2022, and BreachForums, which met a similar fate a year later. Nevertheless, the ongoing struggle between law enforcement and cybercriminals has resembled a game of “whack-a-mole,” as highlighted by recent developments where the FBI and French authorities had to take action again in 2025 to close yet another BreachForums domain.
In a related matter, a collaborative international operation led by Microsoft and Europol has recently disrupted the infamous Tycoon2FA phishing-as-a-service site. Tycoon2FA was notorious for enabling cybercriminals to bypass multi-factor authentication, resulting in the dissemination of tens of millions of phishing messages targeting over 500,000 organizations globally each month.
The concerted efforts by authorities against platforms like LeakBase and Tycoon2FA represent a vital step towards mitigating the risks posed by the underground economy surrounding stolen data. The conclusion of these operations underscores a crucial message: the digital landscape, often perceived as a refuge for cybercriminals, is increasingly under scrutiny by global law enforcement. The relentless pursuit of justice sends a strong warning to those engaging in the trafficking of stolen information—law enforcement agencies will continue their efforts to bring perpetrators to justice.