Category

# Fraud and stolen data takedowns

Actions against the forums, marketplaces, and services that trade in stolen credentials, breached records, and fraud tooling.

Records 11 2020 to 2026

Infrastructure 9 Items recorded as acted on

People named 2 Distinct people in these records

Sources 16 Cited across the category

## What this category covers

Hacking forums, credential and initial access markets, stolen data marketplaces, and the fraud infrastructure built on top of them. Where the same target was acted on more than once, each action is recorded separately.

Every entry below is an action that was carried out, not an announcement of intent. The [counting rules](https://takedownindex.org/about/counting-incidents) and the [inclusion definition](https://takedownindex.org/about/what-counts) apply to this category exactly as they apply to the rest of the index.

What the record does not settle

- 4 of 11 records have a documented successor. Silence in the other rows is not evidence that a service stayed down.
- 1 record carries no established start date.
- Reported figures come from the acting authorities. Named figures come from people recorded individually here. The two are never added together.

## Chronology

| Date | Takedown | Target | Led by | Jurisdictions |
| --- | --- | --- | --- | --- |
| Jan 16, 2020 | [WeLeakInfo seizure](https://takedownindex.org/takedowns/weleakinfo-seizure) | WeLeakInfo | FBI | Not established |
| Apr 12, 2022 | [Operation Tourniquet](https://takedownindex.org/takedowns/operation-tourniquet) | RaidForums | FBI | International |
| Nov 23, 2022 | [iSpoof takedown](https://takedownindex.org/takedowns/ispoof-takedown) | iSpoof | Met Police | Not established |
| Mar 21, 2023 | [BreachForums shutdown following administrator arrest](https://takedownindex.org/takedowns/breachforums-shutdown-following-administrator-arrest) | BreachForums | FBI | United States |
| Apr 4, 2023 | [Operation Cookie Monster](https://takedownindex.org/takedowns/operation-cookie-monster) | Genesis Market | FBI and Dutch National Police | International |
| May 15, 2024 | [BreachForums domain seizure](https://takedownindex.org/takedowns/breachforums-domain-seizure) | BreachForums (reconstituted) | FBI | International |
| Jan 30, 2025 | [HeartSender takedown](https://takedownindex.org/takedowns/heartsender-takedown) | HeartSender ("Saim Raza") | FBI | Not established |
| Oct 10, 2025 | [BreachForums portal seizure (2025)](https://takedownindex.org/takedowns/breachforums-portal-seizure-2025) | BreachForums (further reconstituted) | Not established | International |
| Dec 8, 2025 | [Red Card 2.0](https://takedownindex.org/takedowns/red-card-2-0) | Cross-border online fraud infrastructure | INTERPOL | Not established |
| Mar 3, 2026 | [LeakBase seizure](https://takedownindex.org/takedowns/leakbase-seizure) | LeakBase | FBI | Not established |
| June 2025 | [Serengeti 2.0](https://takedownindex.org/takedowns/serengeti-2-0) | Fraud infrastructure across 18 African countries | INTERPOL and AFRIPOL | Not established |

## Who leads these actions

- [FBI](https://takedownindex.org/organizations/federal-bureau-of-investigation)7 records
- [INTERPOL](https://takedownindex.org/organizations/international-criminal-police-organization)2 records
- [AFRIPOL](https://takedownindex.org/organizations/african-union-mechanism-for-police-cooperation)1 record
- [Met Police](https://takedownindex.org/organizations/metropolitan-police-service)1 record
- [Dutch National Police](https://takedownindex.org/organizations/politie-netherlands-national-police)1 record

## Where they were carried out

- United States5 records
- European Union3 records
- United Kingdom3 records
- France1 record
- Netherlands1 record
- Portugal1 record
- Romania1 record
- Sweden1 record

A takedown is counted once for every country named in its geographic scope, so these figures sum to more than 11.

[Filter the full index by this category](https://takedownindex.org/takedowns?activity_type=fraud_stolen_data)