{"id":15906,"date":"2026-03-06T01:31:50","date_gmt":"2026-03-06T01:31:50","guid":{"rendered":"https:\/\/newestek.com\/?p=15906"},"modified":"2026-03-06T01:31:50","modified_gmt":"2026-03-06T01:31:50","slug":"leakbase-marketplace-unplugged-by-cops-in-14-countries","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=15906","title":{"rendered":"LeakBase marketplace unplugged by cops in 14 countries"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

The LeakBase cyberforum, considered one of the world\u2019s largest online marketplaces for cybercriminals to buy and sell stolen data and cybercrime tools, has been seized by the US, and arrests have also been made in other countries.<\/p>\n

The US Department of Justice said Thursday<\/a> that earlier this week, law enforcement agencies in 14 countries took synchronized action against the site and its 142,000 users, capturing its data and two of the domains used by the forum. Law enforcement also executed search warrants, made arrests, and conducted interviews in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.<\/p>\n

\u201cPrevention messages\u201d were also sent to LeakBase members.<\/p>\n

According to the US and Europol, the European police co-operative, the captured database included credential pairs (usernames and associated passwords), credit and debit card numbers, and bank account and routing information, as well as other sensitive business and personally identifiable information.<\/p>\n

The action started March 3, when around 100 enforcement actions, including arrests and house searches, were conducted worldwide. These included measures against 37 of the most active LeakBase users. The so-called technical phase, the seizure of the forum\u2019s domain and database, took place the next day. That, Europol said, enabled the unmasking of multiple users who believed they were operating anonymously.<\/p>\n

\u201cBy contacting suspects through their preferred digital platforms, investigators delivered a clear message: no one is truly invisible online,\u201d said Europol.<\/p>\n

Law enforcement authorities are proactively continuing to trace digital trails to unmask additional offenders and establish their real-world identities, it added.<\/p>\n

Sending a strong signal to cybercriminals<\/h2>\n

However, one expert says IT leaders shouldn\u2019t hold out much hope that, with this data, law enforcement authorities may be able to warn organizations that they\u2019ve been hacked, or use the data to help victim firms plug vulnerabilities.<\/p>\n

\u201cIn the current climate of the geopolitical turbulence, data sharing between law enforcement and private sector is quite unlikely,\u201d said Ilia \u00a0Kolochenko<\/a>, CEO of Swiss-based Immuniweb. \u201cMoreover, in many jurisdictions, such data sharing may be illegal as it almost inevitably contains data stolen from third parties.\u201d<\/p>\n

While this operation \u201cmarks another remarkable victory of law enforcement over global cybercrime,\u201d he added, \u201cpractical benefits will probably remain modest.<\/p>\n

\u201cFirst, the most dangerous and active cyber mercenaries and state-backed hacking groups are well prepared for a possible seizure of such marketplaces, and leave virtually no digital traces or other incriminating evidence that could help identify them.<\/p>\n

\u201cSecond, even if due to a mistake or omission some cybercriminals will be unmasked, most of them enjoy immunity in non-extradition jurisdictions. Finally, clandestine operators of such marketplaces almost always have a backup and Plan B, swiftly resurrecting like a hydra within several days or weeks.<\/p>\n

\u201cIn sum, while this operation sends a strong signal that cyber offenders will be prosecuted, global cybercrime will continue as usual,\u201d he said.<\/p>\n

Garrett Carstens<\/a>, senior vice-president of intel operations at Intel 471, said CSOs should view the LeakBase takedown as a positive development, but not as a decisive one or one that will translate into easily measurable reduction in cyber risk on its own. \u201cTakedowns can create short-term disruption, intelligence opportunities, and friction for criminals,\u201d he said, \u201cyet the ecosystem typically adapts quickly via migration to other forums or more resilient distribution channels, such as Telegram.\u201d<\/p>\n

It\u2019s good news tactically, he said, but it will have limited strategic impact unless paired with follow-on actions such as arrests, financial interdiction, or other forms of sustained pressure.<\/p>\n

Carstens said to evaluate whether this, or other, takedowns matter for their organization, infosec leaders could track various metrics including, but not limited to, recent fraud activity such as credential-stuffing and account takeover attempts, how quickly any known exposed data appears on alternate forums\/Telegram after a disruption, and the appearance of new phishing kits, new proxy services, and new bot patterns after a takedown.<\/p>\n

Global effort<\/h2>\n

Thanks to international co-operation, a number of criminal marketplaces have been seized in recent years, including BreachForums<\/a> and RaidForums<\/a>.<\/p>\n

Law enforcement agencies involved in various ways in this week\u2019s takedown came from Australia, Belgium, Canada, Germany, Greece, Kosovo, Malaysia, Netherlands, Poland, Portugal, Romania, Spain, the United Kingdom and the US.<\/p>\n

News of the seizure comes the day after the IT infrastructure hosting the Tycoon2FA phishing-as-a-service operation was dismantled<\/a>.<\/p>\n

The takedown of LeakBase \u201cdisrupts a major international platform that cybercriminals use to obtain and profit from the theft of sensitive personal, banking and account credentials,\u201d said US assistant attorney general A. Tysen Duva<\/a>. \u201cThis operation illustrates the strength of the United States and our international partners working across the globe to dismantle a critical cybercriminal forum.\u201d<\/p>\n

In a statement, Edvardas \u0160ileris<\/a>, head of Europol\u2019s European Cybercrime Centre, said the operation \u201cshows that no corner of the internet is beyond the reach of international law enforcement. What began as a shadowy forum for stolen data has now been dismantled, and those who believed they could hide behind anonymity are being identified and held accountable. This is a clear message to cybercriminals everywhere: if you traffic in other people\u2019s stolen information, law enforcement will find you and bring you to justice.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The LeakBase cyberforum, considered one of the world\u2019s largest online marketplaces for cybercriminals to buy and sell stolen data and cybercrime tools, has been seized by the US, and arrests have also been made in other countries. The US Department of Justice said Thursday that earlier this week, law enforcement agencies in 14 countries took synchronized action against the site and its 142,000 users, capturing… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-15906","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/15906","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=15906"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/15906\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15906"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15906"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15906"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}