Skip to main content
Back to the takedown index

BreachForums portal seizure (2025)

January 2025, Fraud and stolen data

Verified core entry, last reviewed August 21, 2026

What was taken down?

Portal infrastructure seized and replaced with a law-enforcement notice.[1]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not established

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

Law enforcement again seized BreachForums infrastructure, which had been used to host extortion pressure pages including a Salesforce-related campaign.[1]

Date
January 2025
Target
BreachForums (further reconstituted), clearnet criminal forum
Activity
Fraud and stolen data
Operational lead
Not established
Jurisdiction
United States and France
Outcome
Portal infrastructure seized and replaced with a law-enforcement notice.
Status
Ongoing
Legal mechanism
US seizure process with French judicial cooperation reported
Group accounted for
Not established

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not established

Neither the operator roster nor the disposition of its members is established in the public record for this action.

Not publicly enumerated.

Under investigation as of the cutoff.[1]

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Additional reporting and technical analysis

  1. [1]
    Specialist reporting on the 2025 BreachForums portal seizure

    Established specialist cybersecurity publication, Source grade S2

    2025 seizure of the BreachForums portal

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • MATERIAL SOURCE GAP. This record lacks an operation-specific official primary source in this research pass. Exact action date is not established. Flagged for verification before import.
  • Retained in the corpus because the seizure banner and multiple specialist reports are consistent, but it should be treated as provisional.