[Back to the takedown index](https://takedownindex.org/takedowns) # BreachForums domain seizure May 2024, Fraud and stolen data Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? No individual outcomes are recorded against this entry. Group accounted for: Members remain at large [See people and accountability](#people) Did it stay down? After this action the service returned with some of the same operators, first seen June 2024. The replacement was itself seized in a later action. Low confidence in the link between the two. [See what happened afterward](#afterward) ## What happened FBI seized the BreachForums clearnet domain and associated Telegram channels, replacing the site with a seizure banner.[[1]](#source-1)[[2]](#source-2) Announced May 15, 2024. **Date:** May 2024 **Target:** BreachForums (reconstituted), clearnet criminal forum **Activity:** Fraud and stolen data **Operational lead:** FBI **Jurisdiction:** United States, United Kingdom, and European Union **Outcome:** Clearnet domain seized and redirected to a seizure notice; associated Telegram infrastructure disrupted. Operators briefly regained the domain via registrar transfer credentials before losing it again. **Status:** Completed **Legal mechanism:** US seizure warrant with international partner support **Group accounted for:** Members remain at large ### Infrastructure 1 domain seized. User accounts seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | breachforums[.]st | 1 domain | Seized, United States | Clearnet domain seized and replaced with a seizure banner. Operators briefly regained control via registrar credentials before losing it again.[[1]](#source-1) | | Not published | User account | Seized | Associated Telegram channels taken over by law enforcement.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Members remain at large No arrests were announced with this action and the operators publicly resumed activity, explicitly demonstrating remaining active members. Administrators operating under the handles ShinyHunters and Baphomet, plus associated staff. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/breachforums-domain-seizure/organizations) ## What happened afterward Forum reconstituted on alternative infrastructure and was seized again in 2025.[[1]](#source-1)[[2]](#source-2) June 2024 BreachForums subsequent iterations. Partial operator continuity. Confidence: Low. Seized in a later action.[[3]](#source-3) The forum repeatedly returned on new infrastructure under overlapping staff handles and was seized again. [Later action: BreachForums portal seizure (2025)](https://takedownindex.org/takedowns/breachforums-portal-seizure-2025) Return class B. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [FBI seizure notice and statement regarding BreachForums](https://takedownindex.org/sources/federal-bureau-of-investigation-fbi-seizure-notice-and-statement-regarding-breac) Federal Bureau of Investigation, May 15, 2024, Source grade P1 Domain and Telegram channel seizure No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. ### Additional reporting and technical analysis 1. [Specialist reporting on the 2024 BreachForums seizure and brief domain recovery](https://takedownindex.org/sources/established-specialist-cybersecurity-publication-specialist-reporting-on-the-202) Established specialist cybersecurity publication, May 16, 2024, Source grade S2 Temporary recovery of the domain by operators No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Specialist reporting on the 2025 BreachForums portal seizure](https://takedownindex.org/sources/established-specialist-cybersecurity-publication-specialist-reporting-on-the-2-2) Established specialist cybersecurity publication, Source grade S2 2025 seizure of the BreachForums portal No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. The temporary recovery of the domain by operators using registrar credentials is a documented and unusual reversal of a seizure and is preserved rather than smoothed over. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 3 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [911 S5 botnet dismantlement](https://takedownindex.org/takedowns/911-s5-botnet-dismantlement) - [Samourai Wallet seizure](https://takedownindex.org/takedowns/samourai-wallet-seizure) - [Operation Cronos wave 1](https://takedownindex.org/takedowns/operation-cronos-wave-1) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)