Skip to Main Content

Breachforum -

The FBI launched a manhunt for Pompompurin. On March 15, 2023, federal agents arrested in Peekskill, New York. He was 20 years old.

Organizations can no longer assume their corporate credentials are secure. Because BreachForums democratized access to raw text passwords from historical leaks, automated "credential stuffing" attacks have surged. Companies are forced to adopt mandatory Multi-Factor Authentication (MFA) and continuous credential monitoring.

: It emerged in 2022 as a successor to RaidForums. It is widely considered one of the most significant hubs for large-scale data breaches, hosting over 14 billion records across 888+ datasets as of mid-2024. Law Enforcement Actions

Hackers often dump small portions of stolen data for free to build "rep" (reputation) within the community.

: The original site was launched by "pompompurin" (Conor Brian Fitzpatrick), who was arrested in New York in March 2023. breachforum

Mara delves into her investigation. Using a pseudonym, she navigates the forum’s multi-factor authentication layers, her heart pounding as she logs in. The interface is eerily organized—subforums like "Medical Data" and "Corporate Espionage" buzz with threads. A hacker named "Phantom" boasts about the BioMed hack, selling access for $500,000 in cryptocurrency. Mara notes the ransomware used: a new variant exploiting IoT vulnerabilities in medical devices.

To understand BreachForums, one must first look at its predecessor. In early 2022, the FBI and international partners seized RaidForums, the reigning king of data leak sites. The vacuum left behind didn’t last long. Within weeks, a user known as "Pompompurin" (later identified as Conor Brian Fitzpatrick) launched BreachForums.

In the underground, no void remains empty for long. Within 48 hours of the seizure, copycat domains like and BreachForums(.cx) appeared. A user known as "ShinyHunters" — ironically, one of the most prolific data thieves of all time — claimed to have taken over the brand.

Shortly after the arrest, the forum was reopened by the hacking group ShinyHunters and a former administrator known as "Baphomet" The FBI launched a manhunt for Pompompurin

Detail the specific, major data breaches that were leaked on the forum. Explain how "stealer logs" are used in cyberattacks. Compare BreachForums to its predecessor, RaidForums. Discuss the legal consequences for users of the site. Let me know how you'd like to . Share public link

However, for the average person, visiting these sites is highly discouraged. Not only are they hubs for illegal activity, but the sites themselves are often laden with malware designed to infect the computers of curious onlookers. How to Protect Yourself

The takedown of BreachForums demonstrates the commitment of law enforcement agencies to combat cybercrime and disrupt the operations of notorious dark web marketplaces. As the dark web continues to evolve, it is essential for authorities, cybersecurity professionals, and individual users to remain vigilant and proactive in the face of emerging threats.

BreachForums has had a significant, negative impact on cybersecurity: : It emerged in 2022 as a successor to RaidForums

In May 2023, users logged into BreachForum to find a shocking message: Domain seized. This was not a traditional "exit scam" (where admins steal user deposits). Instead, the homepage displayed a banner indicating seizure by the , Secret Service , and Dutch National Police .

Operating as the spiritual successor to the notorious RaidForums, BreachForums quickly grew to become the premier marketplace for leaked databases, stolen credentials, and high-profile corporate data. Despite multiple international law enforcement seizures and the arrests of its key administrators, the forum has repeatedly resurfaced, highlighting the persistent challenges global authorities face in dismantling cybercrime infrastructure. The Genesis: Filling the RaidForums Vacuum

Law enforcement had not just taken down the site; they had backdoored it. For weeks, the FBI collected IP addresses, private messages, and cryptocurrency transaction records of the forum’s top users.