Loading story…
Twitter permanently suspended the Distributed Denial of Secrets (DDoSecrets) account after the group published BlueLeaks, a roughly 269GB cache of leaked U.S. law-enforcement files reportedly drawn from more than 200 police departments, fusion centers, and related agencies. The platform also blocked or flagged links to the BlueLeaks portal and DDoSecrets site under its policy on distributing hacked materials. Reports said the data originated from a breach tied to Texas-based web hosting provider Netsential, which hosted law-enforcement information-sharing portals, and that the archive contained sensitive records including personally identifiable information, financial data, suspect images, and internal communications.
The leaked documents were described as the largest known release of U.S. law-enforcement data and were reported to include material showing FBI threat referrals to local police, intelligence reporting on Black Lives Matter protests, and the labeling of protest medics and lawyers as potential extremists. DDoSecrets founder Emma Best criticized Twitter's enforcement, while coverage noted that other leak-publishing entities, including WikiLeaks, had remained accessible on the platform, raising questions about consistency in Twitter's moderation of hacked or leaked material.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Twitter disclosed in a legal filing that parts of its source code had been posted online and sought to identify the person responsible. The report marked a separate leak-related development involving Twitter itself rather than the BlueLeaks incident.
An Intercept report said the BlueLeaks archive exposed private details tied to more than 711,000 accounts from 251 law-enforcement-related websites. It also described how the sites, built and hosted by Netsential on shared Windows infrastructure with a custom ASP.NET/VBScript CMS and Microsoft Access databases, may have been broadly compromised through a single vulnerability.
German authorities seized a server in Falkenstein on 2020-07-03 at the request of the U.S. government after it hosted the BlueLeaks cache published by DDoSecrets. Prosecutors said judicial authorities would decide whether to transfer the seized server to U.S. authorities, while DDoSecrets said the data remained available via BitTorrent and Tor.
A DHS Office of Intelligence and Analysis bulletin circulated to fusion centers in late June 2020 described DDoSecrets as a 'criminal hacker group' and framed BlueLeaks as a hack-and-leak operation targeting law-enforcement databases. The characterization was disputed by DDoSecrets, but it marked a notable U.S. government attribution and escalation in response to the leak.
Twitter permanently banned the DDoSecrets account after the group published BlueLeaks, citing its policy on distributing hacked materials. The platform also began blocking or flagging links to the BlueLeaks/DDoSecrets portal as unsafe.
Distributed Denial of Secrets published BlueLeaks, a roughly 269GB trove of leaked law-enforcement data from more than 200 police departments and related entities. Reporting said the material was linked to a breach of Netsential, a Texas hosting company that maintained law-enforcement data-sharing portals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
12 references tracked. Mallory keeps watching after this page renders.
cnn.com
Open sourcethenation.com
Open sourcebusinessinsider.com
Open sourcetheverge.com
Open sourceweb.archive.org
Open sourcevice.com
Open sourcezdnet.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The extortion group **ExfilSquad** claimed responsibility for breaching the U.K. Police National Legal Database (PNLD), a system managed by West Yorkshire Police, and publishing stolen data on the dark web. PNLD said the incident exposed names, organizations, and work email addresses of police officers, staff, criminal justice professionals, government partners, customers, and some users of the **Ask the Police** service. The group said it stole **1.9GB** of data covering roughly **135,000 records**, while PNLD said it had found no evidence that passwords or other security credentials were compromised and that the database does not hold confidential information on victims, witnesses, or offenders. Authorities said specialist cybersecurity organizations and the **UK National Crime Agency** were involved in the investigation and response. The breach has become a high-profile example of ExfilSquad’s broader hack-and-leak campaign, which targets exposed or misconfigured cloud and SaaS platforms including **Microsoft Dataverse**, **Power Pages**, case management systems, and CRM environments. Researchers said the group recently named **13 additional victims** across the United States, United Kingdom, and Sweden, and has shifted to **torrent-based distribution** of stolen data, using unique trackers and web seeds to make takedowns harder and accelerate spread through P2P networks. Reporting also linked active sharing nodes in **China** and **Russia** to the leaked PNLD data, underscoring the heightened risk of spear-phishing and social engineering against affected police and justice personnel.
Aug 15, 2026
WikiLeaks repeatedly faced disruption tied to high-profile disclosures, including attacks on its infrastructure and government-imposed access restrictions. In one earlier episode, the organization struggled to keep its site online as opponents targeted its domain and hosting arrangements, forcing it to shift providers and addresses to stay reachable. Years later, WikiLeaks said it came under a **sustained attack** after announcing plans to publish roughly **300,000 emails** and **500,000 documents** related to Turkey’s political power structure following the failed coup attempt. After the Turkish document release, authorities in Turkey blocked access to WikiLeaks, escalating the confrontation from network pressure to direct censorship. In a separate but related controversy, WikiLeaks supporters claimed responsibility for the massive **Dyn** distributed denial-of-service incident that disrupted major U.S. websites, framing it as retaliation for Ecuador cutting Julian Assange’s internet access, but investigators and security researchers said there was not enough evidence to attribute the attack to them and pointed instead to **Mirai**-driven botnet activity involving internet-connected devices.
Jun 29, 2026
Hacktivists claiming to be **Anonymous** said they breached web host and domain registrar **Epik**, a provider used by sites including **Gab**, **Parler**, **QAlerts**, and other far-right platforms, and released what they described as roughly a decade of internal and customer data. Reports said the dump included domain registration and transfer records, account credentials, emails, payment history, employee mailbox contents, and more than **500,000 private keys**, affecting data tied to more than **15 million people and websites**. Epik CEO **Rob Monster** initially downplayed the incident, then later acknowledged in a public video session that company backup data appeared to have been compromised and said information from the breach was allegedly used in an attempt to target his Coinbase account. Subsequent reporting said the leaked records exposed internal support tickets, subpoenas, and preservation requests for customer information, including requests that appeared linked to investigations after the **Jan. 6 Capitol riot** and at least one FBI request tied to a domain allegedly connected to malware used in the **SolarWinds** intrusion. The data also reportedly helped trace efforts by figures such as **Ali Alexander** to obscure domain ownership and digital infrastructure, while additional releases expanded scrutiny of how hosting and registrar services supported extremist networks online. The breach became one of the most consequential hacktivist leaks involving internet infrastructure providers because it revealed both customer identities and sensitive law-enforcement-related records.
Jun 29, 2026