International law enforcement shut down the cybercrime forum LeakBase and seized its database under Operation Leak, enabling investigators to identify multiple users and carry out arrests and searches across North America, Europe, and the APAC region. Evidence including account details, forum posts, approximately 215,000 private messages, IP logs, and transaction records was collected, and the takedown was announced alongside disruption of the Tycoon 2FA phishing platform. #LeakBase #OperationLeak
Keypoints
- LeakBase operated since 2021 and had about 142,000 registered users in December 2025 trading stolen credentials, PII, payment card data, and bank details.
- Operation Leak resulted in the seizure of two forum domains and the LeakBase database, enabling identification of multiple users.
- Investigators collected user account details, forum posts, roughly 215,000 private messages, and IP logs as evidence.
- Law enforcement agencies from North America, Europe, and APAC conducted arrests, house searches, and measures against 37 of the forum’s most active users.
- The forum relied on a credit-based economy and reputation system and banned sales of Russia-related data, suggesting the operators’ origin.
Read More: https://www.securityweek.com/leakbase-cybercrime-forum-shut-down-suspects-arrested/