A joint law enforcement operation dismantled LeakBase, one of the world’s largest online forums where cybercriminals buy and sell stolen data and cybercrime tools.
According to the U.S. Department of Justice (DoJ), the LeakBase forum had over 142,000 members as of December 2025, with over 215,000 messages between members. Anyone attempting to access the Forum website (“leakbase”)[.]la”) is currently greeted with a seizure banner indicating that it was seized by the US Federal Bureau of Investigation (FBI) as part of an international law enforcement operation.
“All forum content, including user accounts, posts, credit details, private messages, and IP logs, is securely protected and stored for evidentiary purposes,” the banner reads.
LeakBase, available in English and accessible via Clearnet, provided a hacked database containing hundreds of millions of account credentials and financial information such as credit card numbers, debit card numbers, bank account and routing information, usernames, and associated passwords, which could be exploited to facilitate account takeover.
According to a report published by Flare in April 2023, LeakBase explicitly prohibited users from selling or publishing Russian databases, likely to avoid scrutiny. This forum has been active since 2021.
LeakBase is another name for Chucky, which is also known as Chuckies and Sqlrip on various underground forums. According to SOCRadar, the attacker has a track record of sharing vast collections of databases that often contain sensitive information from entities worldwide.
Additionally, SpyCloud revealed early last month that its forums had been down for several days and that Chucky was looking for a new hosting provider. Other known administrators and moderators of LeakBase include BloodyMery, OrderCheck, and TSR.
As part of a disruption exercise code-named “Operation Leak” that took place on March 3 and 4, 2026, authorities executed search warrants, made arrests, and conducted interviews in the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.
In a coordinated announcement, Europol said LeakBase specializes in selling stealer logs, which contain archives of credentials collected through infostealer malware. This information can be weaponized to commit account takeover, fraud, and other cyber intrusions.
The agency said it had taken about 100 enforcement actions around the world, including unspecified actions against 37 of the platform’s most active users.
“The FBI, Europol, and law enforcement agencies around the world executed a shutdown of LeakBase, one of the largest online cybercrime platforms, and seized user accounts, postings, credentials, private messages, and IP logs for evidentiary purposes,” said Brett Leatherman, FBI Cyber Division Deputy Director.
Source link
