[Back to the takedown index](https://takedownindex.org/takedowns)

# BreachForums portal seizure (2025)

January 2025, Fraud and stolen data

Verified core entry, last reviewed August 21, 2026

What was taken down?

Portal infrastructure seized and replaced with a law-enforcement notice.[[1]](#source-1)

[See what happened](#what-happened)

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not established

[See people and accountability](#people)

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

[See what happened afterward](#afterward)

## What happened

Law enforcement again seized BreachForums infrastructure, which had been used to host extortion pressure pages including a Salesforce-related campaign.[[1]](#source-1)

**Date:** January 2025

**Target:** BreachForums (further reconstituted), clearnet criminal forum

**Activity:** Fraud and stolen data

**Operational lead:** Not established

**Jurisdiction:** United States and France

**Outcome:** Portal infrastructure seized and replaced with a law-enforcement notice.

**Status:** Ongoing

**Legal mechanism:** US seizure process with French judicial cooperation reported

**Group accounted for:** Not established

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not established

Neither the operator roster nor the disposition of its members is established in the public record for this action.

Not publicly enumerated.

## What happened afterward

Under investigation as of the cutoff.[[1]](#source-1)

Not established in the public record. No later activity is recorded against this entry.

Return class G. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about).

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### Additional reporting and technical analysis

1.
[Specialist reporting on the 2025 BreachForums portal seizure](https://takedownindex.org/sources/established-specialist-cybersecurity-publication-specialist-reporting-on-the-2-2)

Established specialist cybersecurity publication, Source grade S2

2025 seizure of the BreachForums portal

No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
- MATERIAL SOURCE GAP. This record lacks an operation-specific official primary source in this research pass. Exact action date is not established. Flagged for verification before import.
- Retained in the corpus because the seizure banner and multiple specialist reports are consistent, but it should be treated as provisional.

Research context

## How this entry was checked

This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source.

Source review: Verified core

Sources cited: 1

Research cutoff: August 20, 2026

Last reviewed August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [HeartSender takedown](https://takedownindex.org/takedowns/heartsender-takedown)
- [BreachForums domain seizure](https://takedownindex.org/takedowns/breachforums-domain-seizure)
- [Serengeti 2.0](https://takedownindex.org/takedowns/serengeti-2-0)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about#corrections-and-updates)