Loading story…
Investigative reporting linked the forum LeakedBB to Christchurch-based crypto entrepreneur Jitendra Maharaj, alleging the site monetized non-consensual intimate imagery, hacked or stolen explicit content, and user requests for such material. The reporting said LeakedBB had millions of registered users, drew roughly two million visits per month in spring 2026, and used paid memberships, credits, and rewards for users who posted purported "leaks." Evidence cited included payment flows through Logica Limited and logica.nz, DNS and certificate links involving mybbplugins.com, archived social media promotion, and historical MyBB-related accounts tied to Maharaj; he denied knowing who operated the forum and said the evidence appeared manufactured. After reporters submitted detailed questions, NOWPayments deactivated LeakedBB’s account for terms-of-service violations, and the site went offline.
The allegations align with broader U.S. law-enforcement action against image-based sexual exploitation enabled by hacking and online coercion. Federal prosecutors in Massachusetts charged an Illinois man in a Snapchat hacking investigation and separately secured a five-year prison sentence for a former college track and field coach convicted of sextortion, cyberstalking, and cyber fraud. Together, the cases show authorities and investigators targeting both the platforms and the individuals involved in trafficking hacked or coerced intimate material online.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Bellingcat and The Press reported technical and financial links pointing to Christchurch-based Jitendra Maharaj in connection with LeakedBB, citing payment, DNS, certificate, and historical MyBB-related account evidence. Maharaj denied knowing who operated the forum and said the evidence sounded manufactured.
After receiving reporters' questions, NOWPayments deactivated LeakedBB's account for terms-of-service violations. The reporting ties this action to scrutiny over the forum's alleged monetization of non-consensual intimate imagery and hacked or stolen explicit content.
By June 6, 2026, LeakedBB had gone offline and remained inaccessible at the time of publication. The site had allegedly operated as a large forum trading in non-consensual intimate imagery and purported leaks.
On June 4, 2026, reporters sent detailed questions concerning technical and financial links between LeakedBB and Christchurch-based Jitendra Maharaj.
On March 6, 2024, former college track-and-field coach Steve Waithe was sentenced to five years in prison for sextortion, cyberstalking, and cyber fraud in the District of Massachusetts.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
bellingcat.com
Open sourcejustice.gov
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BreachForums suffered repeated compromises that exposed member data across multiple iterations of the cybercrime forum. An earlier breach leaked details on about **4,000 members**, while a later incident tied to the forum's reboot reportedly spilled data on roughly **325,000 users**, underscoring the scale of exposure affecting one of the most prominent underground marketplaces. Reporting on the more recent compromise said the forum was hit through a **MyBB `0-day`** affecting unpatched software, with forum administrators claiming the intrusion was also linked to a broader law-enforcement crackdown. The incident disrupted the platform, prompted leadership changes including the emergence of a new admin, and highlighted how even criminal forums remain vulnerable to the same software flaws, operational failures, and data-security lapses that they routinely exploit in others.
Jul 12, 2026
The **FBI**, working with European and other international law enforcement partners, seized and dismantled the **LeakBase** cybercriminal forum and marketplace in a coordinated action dubbed **“Operation Leak.”** LeakBase, active since 2021 and run as a subscription-based service, was used to buy, sell, and share stolen databases and sensitive data including **compromised credentials**, **PII**, payment data, and other access-enabling information; authorities warned that the forum facilitated activity that could enable access to U.S.-based networks, including potentially **critical infrastructure**. Authorities redirected LeakBase domains (including `leakbase[.]ws` and `leakbase[.]la`) to an FBI seizure banner and moved DNS to bureau-controlled infrastructure (e.g., `ns1.fbi.seized.gov`, `ns2.fbi.seized.gov`). The takedown was executed under U.S. and German court orders, and officials stated they secured and preserved the forum’s content for evidentiary purposes, including user accounts, posts, private messages, and **IP logs**. The operation reportedly included **100 law enforcement actions** against **45 targets** across more than a dozen countries, disruption of hosting infrastructure spanning locations such as the Netherlands and Malaysia, and outcomes including **13 arrests**, **32 searches**, and interviews with **33 suspects**; the investigation was led by the FBI’s Salt Lake City field office, and the FBI solicited tips via `FBI-SU-Leakbase@fbi.gov`.
Jun 29, 2026
ShinyHunters said it has abandoned **BreachForums** and released an updated database affecting more than **300,000 users** of the cybercrime marketplace. Reports say the leak goes beyond basic credentials and includes full account profile and activity data, including usernames, email addresses, hashed passwords, salts, IP addresses, login metadata, and forum activity timestamps. The group said maintaining the forum ecosystem became a "waste of time" after the FBI seizure of BreachForums and claimed that all currently active BreachForums domains are fake. ShinyHunters also threatened to publish fuller backups — including private messages, posts, and additional user data — unless the remaining forums shut down, while asserting it holds exploits for all **MyBB 1.8** versions; the identity of the operators behind current BreachForums instances remains unclear, with speculation ranging from opportunistic criminals to possible law enforcement honeypots.
Jun 29, 2026