Loading story…
The FBI escalated its investigation into LulzSec and affiliated Anonymous hackers by seizing server racks from a Reston, Virginia data center used by Swiss host DigitalOne, knocking multiple unrelated websites and services offline. According to reporting, agents were pursuing one customer but removed three equipment enclosures that may have held systems for many other clients, disrupting sites including Curbed Network, Instapaper, and Pinboard even though they were not identified as targets. U.S. officials said the operation was part of an active, broader inquiry supported by other agencies and international cybercrime partners.
The enforcement push widened with arrests and searches tied to suspected members on both sides of the Atlantic. British authorities arrested a teenager on suspicion of hacking, while reports also described the arrest in London of a leading LulzSec figure and FBI raids on homes of suspected Anonymous participants in the United States, including a search in Hamilton, Ohio linked to the online alias m_nerva. Reporting said investigators drew on evidence connected to Ryan Cleary, who was charged under the UK Computer Misuse Act, as authorities worked to identify participants in the group after a string of high-profile intrusions and internal leaks exposed tensions inside LulzSec.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
On 2011-07-19, authorities in London arrested a person described in reporting as a leading member of the LulzSec hacking group. The arrest marked a significant law-enforcement action against the group's core membership.
By 2011-07-19, U.S. authorities had carried out raids on homes of people suspected of involvement with Anonymous-related hacking activity. The action reflected an escalation of the broader law-enforcement crackdown connected to Anonymous and LulzSec investigations.
On 2011-06-29, FBI agents searched the home of a teenager in Hamilton, Ohio, suspected of being the LulzSec figure "m_nerva." No charges were filed following the search, and reporting said the investigation was informed in part by interviews and data obtained from Ryan Cleary.
A teenager was arrested in the United Kingdom on suspicion of hacking as part of the widening investigation into LulzSec. Reporting tied the arrest to Ryan Cleary of Essex, who was later described as facing charges under the UK Computer Misuse Act while LulzSec denied he was a member.
In an early-morning raid at a Reston, Virginia data center on 2011-06-21, the FBI removed three equipment enclosures used by Swiss hosting provider DigitalOne while pursuing one client of interest. The seizure disrupted tens of unrelated customers, including sites and services such as Curbed Network, Instapaper, and Pinboard.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
web.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcebits.blogs.nytimes.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
LulzSec carried out a short but highly visible campaign of intrusions and disruption against media, government, law-enforcement, and gaming targets, including **PBS**, **Sony Pictures**, the **U.S. Senate**, **InfraGard**, the **CIA** website, and the UK's **SOCA**. The group used website defacements, data theft, credential leaks, SQL injection, and distributed denial-of-service attacks, while amplifying its notoriety through Twitter, leaked data dumps, a public call-in line for target suggestions, and the broader **AntiSec** push alongside Anonymous. One early operation followed PBS reporting on WikiLeaks, and later leaked chat logs portrayed LulzSec as a small, publicity-driven but operationally cautious crew led by **Sabu**, with members such as **Topiary** and **Kayla**, amid internal strain and growing fear of retaliation. Law-enforcement pressure quickly escalated on both sides of the Atlantic. British police arrested and charged **Ryan Cleary** over alleged botnet and DDoS activity tied to attacks including SOCA, though LulzSec denied he was a core member, and later cases identified **Jake Davis**, **Ryan Ackroyd**, and others as participants or associates. In the U.S., authorities revealed that LulzSec leader **Hector Xavier Monsegur** (`Sabu`) had become an FBI informant after his arrest, helping investigators prevent hundreds of attacks and identify co-conspirators. The group announced it was disbanding after roughly 50 days, but prosecutions continued: multiple suspects were arrested in coordinated international operations, two British members later pleaded guilty, and subsequent court filings tied the campaign to substantial financial and operational damage across numerous victims.
Jun 29, 2026
An international law-enforcement operation involving the **FBI**, **Europol**, and authorities across **14 countries** seized infrastructure used by **LeakBase**, a major cybercrime marketplace/forum used to trade stolen data, exploits, and hacking services. Investigators reportedly seized LeakBase domains, displayed seizure banners, executed search warrants, and made arrests; forum data (including user accounts, messages, and IP logs) was preserved to support follow-on investigations and deterrence efforts. Separate reporting in the same news cycle described other unrelated cyber developments, including Europol-led disruption of the **Tycoon2FA** phishing-as-a-service platform (used for adversary-in-the-middle MFA bypass), a guilty plea tied to the **Phobos** ransomware operation, a newly documented China-linked espionage cluster (**CL-UNK-1068**) targeting critical sectors in Asia, an unverified **ShinyHunters** extortion claim against *Woflow*, suspected DPRK-linked intrusions against cryptocurrency firms, and a pro-Iranian/pro-Palestinian ransomware ecosystem shift from **Sicarii** to **BQTLock**. Those items do not materially change the core LeakBase takedown but indicate continued pressure on cybercrime infrastructure alongside ongoing ransomware and espionage activity.
Jun 29, 2026
The **FBI**, working with European and other international law enforcement partners, seized and dismantled the **LeakBase** cybercriminal forum and marketplace in a coordinated action dubbed **“Operation Leak.”** LeakBase, active since 2021 and run as a subscription-based service, was used to buy, sell, and share stolen databases and sensitive data including **compromised credentials**, **PII**, payment data, and other access-enabling information; authorities warned that the forum facilitated activity that could enable access to U.S.-based networks, including potentially **critical infrastructure**. Authorities redirected LeakBase domains (including `leakbase[.]ws` and `leakbase[.]la`) to an FBI seizure banner and moved DNS to bureau-controlled infrastructure (e.g., `ns1.fbi.seized.gov`, `ns2.fbi.seized.gov`). The takedown was executed under U.S. and German court orders, and officials stated they secured and preserved the forum’s content for evidentiary purposes, including user accounts, posts, private messages, and **IP logs**. The operation reportedly included **100 law enforcement actions** against **45 targets** across more than a dozen countries, disruption of hosting infrastructure spanning locations such as the Netherlands and Malaysia, and outcomes including **13 arrests**, **32 searches**, and interviews with **33 suspects**; the investigation was led by the FBI’s Salt Lake City field office, and the FBI solicited tips via `FBI-SU-Leakbase@fbi.gov`.
Jun 29, 2026