In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums.
The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre la Cybercriminalité (BL2C) and the Parquet de Paris (JUNALCO).
This action represents the latest chapter in the long-running campaign to dismantle the persistent data leak site.
Seizure of BreachForums Domain
The breachforums[.]hn domain was first spotted in August 2025 as the new home for BreachForums.
Site visitors now see a notice stating the domain is under law enforcement control, with contact details for anyone who has information about the forum’s activities.
The DOJ and FBI partnered with BL2C and JUNALCO to carry out the operation, demonstrating strong international collaboration against cybercrime.
This version of BreachForums had gained attention as the clearnet outlet for the hacking alliance known as the “Trinity of Chaos” or “Scattered Lapsus$ Hunters.”
This group blended members of Scattered Spider, Lapsus$, and ShinyHunters. In a surprising move, they posted a farewell message announcing their retirement. Despite the announcement, investigators continued monitoring the site until its takeover.
BreachForums first emerged as the successor to RaidForums, which was shut down by law enforcement in 2022.
The original founder of BreachForums, Conor Brian Fitzpatrick (alias “Pompompurin”), was arrested in March 2023.
Despite his arrest, the platform reemerged under new administrators within days. In May 2024, the FBI and global partners seized BreachForums once more, only to see it resurface within weeks under the control of ShinyHunters.
Over the years, authorities have arrested several individuals linked to the forum. In June 2025, four people in France faced charges for administering the site.
Yet each disruption has been met with rapid rebirths on fresh domains, fueling an ongoing cycle of takedowns and relaunches.
In August 2025, ShinyHunters warned that the forum was compromised and serving as a law enforcement honeypot, further illustrating the forum’s chaotic leadership and internal strife.
While the clearnet site breachforums[.]hn is now offline, reports suggest that a dark web version of BreachForums remains active.
Criminals may shift to that hidden platform to trade stolen data and hacking tools. Law enforcement agencies warn that the domain seizure will not end the threat posed by this marketplace.
Investigators stress that dismantling these sites requires constant vigilance and cooperation across borders.
The recent operation underscores the determination of global agencies to disrupt cybercrime networks at every turn.
As BreachForums’ administrators adapt and migrate, authorities will need to track new domains and seize them quickly to prevent further leaks of sensitive data.
The battle against online marketplaces for stolen information is far from over, and this latest seizure is a clear signal that law enforcement will continue to strike wherever these operations reemerge.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
