International law enforcement agencies have seized the latest clearnet domain of the notorious cybercrime marketplace, BreachForums.
The domain, breachforums[.]hn, now displays a seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre la Cybercriminalité (BL2C) and the Parquet de Paris (JUNALCO).
This action marks another chapter in the ongoing battle to dismantle the persistent data leak site. The seizure notice confirms the domain is under the control of law enforcement and provides contact details for individuals to report information about the forum’s criminal activities.
The breachforums[.]hn domain was a relatively new home for the illicit forum, having been highlighted as a new domain for the site in August 2025.
The site was notably used by the hacking supergroup known as the “Trinity of Chaos” or “Scattered Lapsus$ Hunters”—an alliance of the notorious Scattered Spider, Lapsus$, and ShinyHunters groups to post a “goodbye letter” announcing their supposed retirement from the cybercrime scene.
Cycle of Seizures
BreachForums has a long and turbulent history, marked by numerous takedowns and rapid rebirths. The platform first emerged as a successor to RaidForums, another hacking forum seized by law enforcement in 2022.
The original BreachForums was shut down in March 2023 following the arrest of its founder, Conor Brian Fitzpatrick, known as “Pompompurin”.
Despite the arrest, the forum was quickly revived by other administrators. In May 2024, the FBI and international partners seized the site again, but it resurfaced within weeks under the control of the ShinyHunters threat actor group.
The forum has since operated on a series of different domains, continuing its role as a key marketplace for stolen databases, hacking tools, and other contraband.
Over the years, law enforcement has made several arrests connected to the forum’s administration, including four individuals in France in June 2025. However, the core operation has proven resilient, with new administrators and domains appearing after each disruption.
This latest seizure follows a period of significant turmoil for the groups running the forum. In August 2025, ShinyHunters issued a warning that BreachForums had been compromised and was being operated as a law enforcement honeypot.
The recent seizure of the .hn domain coincides with the apparent dissolution of the “Scattered Lapsus$ Hunters” alliance.
A corresponding Telegram channel used by the group descended into chaos, with members expressing confusion over the disappearance of the key figure “Shiny” before an administrator locked the channel down.
While the clearnet site has been taken down, some reports suggest its dark web counterpart remains operational, indicating that the fight against the cybercrime enterprise is likely to continue.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
