Skip to main content
Back to the takedown index

BreachForums domain seizure

May 2024, Fraud and stolen data
Led by Federal Bureau of Investigation

Verified core entry, last reviewed August 21, 2026

What was taken down?

Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.[1][2]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Members remain at large

See people and accountability

Did it stay down?

After this action the service returned with some of the same operators, first seen June 2024. The replacement was itself seized in a later action. Low confidence in the link between the two.

See what happened afterward

FBI seized the BreachForums clearnet domain and associated Telegram channels, replacing the site with a seizure banner.[1][2]

Announced May 15, 2024.

Date
May 2024
Target
BreachForums (reconstituted), clearnet criminal forum
Activity
Fraud and stolen data
Operational lead
FBI
Jurisdiction
United States, United Kingdom, and European Union
Outcome
Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.
Status
Completed
Legal mechanism
US seizure warrant with international partner support
Group accounted for
Members remain at large

Infrastructure

1 domain seized. User accounts seized, with no count in the record.

1
domain seized
Identifier Recorded as Status Notes
breachforums[.]st 1 domain Seized, United States Clearnet domain seized and replaced with a seizure banner. Operators briefly regained control via registrar credentials before losing it again.[1]
Not published User account Seized Associated Telegram channels taken over by law enforcement.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Members remain at large

No arrests were announced with this action and the operators publicly resumed activity, explicitly demonstrating remaining active members.

Administrators operating under the handles ShinyHunters and Baphomet, plus associated staff.

See the organizations and roles behind this action

Forum reconstituted on alternative infrastructure and was seized again in 2025.[1][2]

  1. June 2024

    BreachForums subsequent iterations. Partial operator continuity. Confidence: Low. Seized in a later action.[3]

    The forum repeatedly returned on new infrastructure under overlapping staff handles and was seized again.

    Later action: BreachForums portal seizure (2025)

June 2024

BreachForums subsequent iterations. Partial operator continuity. Confidence: Low. Seized in a later action.[3]

The forum repeatedly returned on new infrastructure under overlapping staff handles and was seized again.

Later action: BreachForums portal seizure (2025)

Return class B. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    FBI seizure notice and statement regarding BreachForums

    Federal Bureau of Investigation, May 15, 2024, Source grade P1

    Domain and Telegram channel seizure

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Additional reporting and technical analysis

  1. [2]
    Specialist reporting on the 2024 BreachForums seizure and brief domain recovery

    Established specialist cybersecurity publication, May 16, 2024, Source grade S2

    Temporary recovery of the domain by operators

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [3]
    Specialist reporting on the 2025 BreachForums portal seizure

    Established specialist cybersecurity publication, Source grade S2

    2025 seizure of the BreachForums portal

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. The temporary recovery of the domain by operators using registrar credentials is a documented and unusual reversal of a seizure and is preserved rather than smoothed over.