Skip to main content

Cybersecurity report

The BreachForums Succession Wars

KELA Cyber Intelligence Center, June 13, 2026. KELA's mapping of the successor forums that followed the October 2025 FBI seizure of BreachForums, used for the three resurgence records on td_2025_breachforums: the original breachforums[.]as lineage run by administrators 'Indra' and 'N/A', which collapsed in an exit-scam scandal; Breached (breached[.]st / breached[.]su), launched by co-creator HasanBroker in January 2026 and now owned by co-creator 'diencracked' with the TeamPCP hacking group, claiming to have imported roughly 324,000 BreachForums users; and PWN (pwnforums[.]st), which emerged publicly in April 2026 as a moderator-led successor carrying over accounts, ranks and credits from breachforums[.]as..

Source type
Cybersecurity report
Published
June 13, 2026
Research grade
T2
Used in entries
3

Bibliographic record

Publisher
KELA Cyber Intelligence Center
Published
June 13, 2026
Source type
Cybersecurity report
Research grade
Source grade T2
Language
English
Official record
Not an official publication
Address
https://www.kelacyber.com/blog/breachforums-succession-wars-2026/
What it supports
KELA's mapping of the successor forums that followed the October 2025 FBI seizure of BreachForums, used for the three resurgence records on td_2025_breachforums: the original breachforums[.]as lineage run by administrators 'Indra' and 'N/A', which collapsed in an exit-scam scandal; Breached (breached[.]st / breached[.]su), launched by co-creator HasanBroker in January 2026 and now owned by co-creator 'diencracked' with the TeamPCP hacking group, claiming to have imported roughly 324,000 BreachForums users; and PWN (pwnforums[.]st), which emerged publicly in April 2026 as a moderator-led successor carrying over accounts, ranks and credits from breachforums[.]as.
Dataset id
src_kela_breachforums_succession_wars_2026

Research notes

  • The article's on-page headline and schema.org headline are both 'The BreachForums Succession Wars'; the og:title used for search listings is different ('BreachForums Successors in 2026: PWN vs Breached') and is not the headline.
  • published_on is the schema.org datePublished, 2026-06-13T14:43:49Z. The page also carries dateModified 2026-06-22T09:15:51Z and displays 'Updated June 22, 2026'.
  • One divergence from the citing resurgence record: KELA attributes the launch of breached[.]st in January 2026 to HasanBroker, with 'diencracked' and TeamPCP as the current owners, rather than crediting the launch itself to 'diencracked'.

How this source is used

Cited 3 times across 1 record type.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

Later activity

3 citations

Cited for activity recorded after the takedown.

All sources