Category
Fraud and stolen data takedowns
Actions against the forums, marketplaces, and services that trade in stolen credentials, breached records, and fraud tooling.
What this category covers
Hacking forums, credential and initial access markets, stolen data marketplaces, and the fraud infrastructure built on top of them. Where the same target was acted on more than once, each action is recorded separately.
Every entry below is an action that was carried out, not an announcement of intent. The counting rules and the inclusion definition apply to this category exactly as they apply to the rest of the index.
What the record does not settle
- 4 of 11 records have a documented successor. Silence in the other rows is not evidence that a service stayed down.
- 1 record carries no established start date.
- Reported figures come from the acting authorities. Named figures come from people recorded individually here. The two are never added together.
Chronology
| Date | Takedown | Target | Led by | Jurisdictions |
|---|---|---|---|---|
| Jan 16, 2020 | WeLeakInfo seizure | WeLeakInfo | FBI | Not established |
| Apr 12, 2022 | Operation Tourniquet | RaidForums | FBI | International |
| Nov 23, 2022 | iSpoof takedown | iSpoof | Met Police | Not established |
| Mar 21, 2023 | BreachForums shutdown following administrator arrest | BreachForums | FBI | United States |
| Apr 4, 2023 | Operation Cookie Monster | Genesis Market | FBI and Dutch National Police | International |
| May 15, 2024 | BreachForums domain seizure | BreachForums (reconstituted) | FBI | International |
| Jan 30, 2025 | HeartSender takedown | HeartSender ("Saim Raza") | FBI | Not established |
| Oct 10, 2025 | BreachForums portal seizure (2025) | BreachForums (further reconstituted) | Not established | International |
| Dec 8, 2025 | Red Card 2.0 | Cross-border online fraud infrastructure | INTERPOL | Not established |
| Mar 3, 2026 | LeakBase seizure | LeakBase | FBI | Not established |
| June 2025 | Serengeti 2.0 | Fraud infrastructure across 18 African countries | INTERPOL and AFRIPOL | Not established |
Who leads these actions
- FBI 7 records
- INTERPOL 2 records
- AFRIPOL 1 record
- Met Police 1 record
- Dutch National Police 1 record
Where they were carried out
- United States 5 records
- European Union 3 records
- United Kingdom 3 records
- France 1 record
- Netherlands 1 record
- Portugal 1 record
- Romania 1 record
- Sweden 1 record
A takedown is counted once for every country named in its geographic scope, so these figures sum to more than 11.