In a significant blow to cybercrime, law enforcement agencies from 14 countries, coordinated by Europol, have successfully shut down LeakBase, one of the world’s largest online marketplaces for stolen data and hacking tools. This coordinated operation, which commenced in March, involved nearly 100 enforcement actions, resulting in several arrests, house searches, and the seizure of the forum’s database along with its domains.
LeakBase, operational since 2021, had gained notoriety for hosting an extensive repository of hacked databases. These databases contained hundreds of millions of stolen credentials, including credit card numbers and banking details, and catered to its 142,000 registered members. The platform’s servers were located in Amsterdam, where the coordinated actions were initiated by Dutch authorities in 2023 in partnership with the FBI and Europol.
The FBI redirected the site’s domain to agency-controlled servers, replacing it with a police warning message. The operation specifically targeted the forum’s top 37 active users and led to over 13 arrests and interviews with 33 suspects globally. Despite the success of the operation, security experts caution that its practical impact might be limited, as sophisticated cybercriminals tend to operate from jurisdictions that do not permit extradition, and such underground marketplaces often quickly migrate to alternative platforms like Telegram.
Experts recommend that information security leaders continue to monitor metrics such as credential-stuffing attempts and the reappearance of the stolen data on alternative forums to assess the long-term implications of the takedown. While the closure of LeakBase sends a powerful signal against cybercrime, the evolving nature of such criminal ecosystems warrants ongoing vigilance and adaptive security measures.

Collections

Law enforcement agencies from 14 countries, coordinated by Europol, have shut down LeakBase, a major cybercriminal marketplace operational since 2021. The platform hosted hundreds of millions of stolen credentials and served 142,000 registered members. The operation involved nearly 100 enforcement actions, over 13 arrests, and seizure of the forum's database and domains. Despite the takedown, security experts warn the impact may be limited as sophisticated cybercriminals often operate from non-extradition jurisdictions and tend to migrate to alternative platforms like Telegram. Security leaders are advised to monitor credential-stuffing attempts and watch for stolen data reappearing on other forums.

Global Law Enforcement Shuts Down Major Cybercrime Hub LeakBase