FBI and International Partners Dismantle LeakBase Cybercrime Forum

A coordinated international law enforcement operation known as Operation Leak has dismantled LeakBase, a major cybercrime forum used by threat actors to buy and sell stolen data, hacking tools, and illicit cyber services. Active since 2021 and accessible on the clearnet, the platform had grown to more than 142,000 members and over 215,000 posts by late 2025, becoming a significant marketplace for leaked databases, exploits, and infostealer logs containing credentials harvested from compromised systems. The forum enabled cybercriminal activity such as account takeovers, financial fraud, and network intrusions by providing access to large collections of stolen account credentials, banking and payment card information, and other sensitive data. Law enforcement agencies across fourteen (14) countries, including the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom, conducted coordinated actions on March 3 – 4, 2026, which included arrests, search warrants, interviews, and “knock-and-talk” interventions targeting thirty-seven (37) of the platform’s most active users. Authorities seized LeakBase’s domains and replaced them with an FBI seizure notice, while also securing the forum’s database, including user accounts, posts, credit details, private messages, and IP logs for evidentiary purposes. The site was reportedly operated by a threat actor known as Chucky (also using the aliases Chuckies and Sqlrip), alongside moderators including BloodyMery, OrderCheck, and TSR, and notably prohibited the sale of Russian data to avoid scrutiny. Europol reported roughly 100 enforcement actions worldwide, and officials say the operation will now move into a prevention phase aimed at deterring cybercriminal activity and raising awareness of the consequences of participating in online cybercrime marketplaces. The takedown continues a broader trend of international law enforcement disruptions of major cybercrime communities, following earlier operations against RaidForums in 2022 and BreachForums in 2023, as well as the conviction and sentencing of the BreachForums founder in 2025.