Breachforum [top]

The vacuum left by RaidForums was massive. Enter a young, tech-savvy threat actor operating under the pseudonym (later identified as Conor Brian Fitzpatrick ). Within weeks of RaidForums’ demise, Pompompurin launched BreachForums (often stylized as "BreachForums" or "Breached.vc").

Under Pompompurin’s leadership, BreachForums exploded in popularity. Unlike traditional dark web marketplaces that require specialized browsers like Tor, BreachForums actively maintained clearnet domains alongside its onion routing mirrors. This made it highly accessible to the general public, journalists, and amateur "script kiddies."

BreachForums represents a significant chapter in the history of cybercrime—a highly publicized, resilient hub that adapted to law enforcement actions. While the platform itself may come and go, the demand for stolen data ensures that similar, dangerous forums will continue to emerge. Understanding the tactics utilized on these platforms is essential for maintaining robust defense systems in a data-driven world.

To minimize "ripping" (scamming among cybercriminals), administrators and trusted moderators act as escrow agents. For a percentage fee, they hold funds until the buyer verifies the validity of the purchased corporate access or database. Tiered Subscriptions

. Under his leadership, the forum quickly gained traction by hosting massive datasets, including personal details allegedly belonging to 1 billion Chinese residents breachforum

Cybercrime forums are notoriously difficult to kill permanently. Following Fitzpatrick's arrest, several "clones" and "successors" emerged, most notably the version led by an individual known as . Despite a major international law enforcement operation in May 2024—which resulted in the seizure of the .st and .cx domains—the forum has consistently managed to migrate to new domains or Telegram channels.

The rapid growth and high visibility of BreachForums inevitably made it the top target for Western law enforcement agencies. The turning point came in March 2023.

Mara delves into her investigation. Using a pseudonym, she navigates the forum’s multi-factor authentication layers, her heart pounding as she logs in. The interface is eerily organized—subforums like "Medical Data" and "Corporate Espionage" buzz with threads. A hacker named "Phantom" boasts about the BioMed hack, selling access for $500,000 in cryptocurrency. Mara notes the ransomware used: a new variant exploiting IoT vulnerabilities in medical devices.

The timeline of BreachForums is a cyclical battle of domain seizures, administrator arrests, and infrastructure migrations. Era / Iteration Primary Administrator Status / Outcome (2022–2023) Pompompurin (Conor Fitzpatrick) Seized by FBI; administrator arrested. BreachForums v2 (2023–2024) Baphomet / ShinyHunters Seized via joint global law enforcement action. BreachForums v3 (2024–Present) ShinyHunters (Decentralized) Relaunched via dark web onions and alternative domains. The vacuum left by RaidForums was massive

Within weeks, the forum reappeared under the leadership of another administrator, "ShinyHunters," demonstrating the resilience of the community.

This article explores the origins of BreachForums, its operational dynamics, the pivotal role it played in major data breaches, and the ongoing saga of its closures and re-emergences. 1. Origins and Rise to Prominence (Post-RaidForums)

of different platforms to protect your data.

The existence of platforms like BreachForums poses significant cybersecurity risks, as they: While the platform itself may come and go,

Other moderators—known by handles like and "NahamSec" (the latter was an unwitting security researcher who later cooperated)—were either arrested or doxxed by rival hacker groups.

BreachForums (and its various iterations) is an English-language cybercrime forum and marketplace primarily used for the trade and distribution of stolen data Operational History and Key Reviews Purpose and Impact

Despite the operators' best efforts at anonymity, law enforcement agencies around the world have repeatedly targeted BreachForums and its key figures, resulting in several high-profile arrests, seizures, and convictions.

BreachForums (often referred to as ) has been a central, yet highly unstable, fixture in the cybercriminal underground since its launch in March 2022. It primarily serves as a marketplace for buying and selling stolen data , hacking tools, and various illicit services. Recent Major Developments (2025–2026)