Operation Leak Takedown of LeakBase Cybercriminal Forum

The FBI, working with European and other international law enforcement partners, seized and dismantled the LeakBase cybercriminal forum and marketplace in a coordinated action dubbed “Operation Leak.” LeakBase, active since 2021 and run as a subscription-based service, was used to buy, sell, and share stolen databases and sensitive data including compromised credentials, PII, payment data, and other access-enabling information; authorities warned that the forum facilitated activity that could enable access to U.S.-based networks, including potentially critical infrastructure.

Authorities redirected LeakBase domains (including leakbase[.]ws and leakbase[.]la) to an FBI seizure banner and moved DNS to bureau-controlled infrastructure (e.g., ns1.fbi.seized.gov, ns2.fbi.seized.gov). The takedown was executed under U.S. and German court orders, and officials stated they secured and preserved the forum’s content for evidentiary purposes, including user accounts, posts, private messages, and IP logs. The operation reportedly included 100 law enforcement actions against 45 targets across more than a dozen countries, disruption of hosting infrastructure spanning locations such as the Netherlands and Malaysia, and outcomes including 13 arrests, 32 searches, and interviews with 33 suspects; the investigation was led by the FBI’s Salt Lake City field office, and the FBI solicited tips via FBI-SU-Leakbase@fbi.gov.