BreachForums
Cybercrime forum
From Wikipedia, the free encyclopedia
BreachForums, sometimes referred to as Breached, was an English-language black-hat hacking crime forum. The website acted as an alternative and successor to RaidForums following its shutdown and seizure in 2022.[2] Like its predecessor, BreachForums allowed discussions concerning hacking and facilitated the distribution of data obtained through data breaches, hacking tools and various other services.
| |
Website type | Internet forum |
|---|---|
| Available in | English |
| Predecessor | RaidForums |
Country of origin | United States |
| Founders | Conor Brian Fitzpatrick, also known by his screen name "pompompurin" |
| Website | breachforums.st /.cx/.is/.vc |
| Advertising | Yes |
| Commercial | Yes |
| Users | Approximately 324,000 in August 2025[1] |
| Launched | March 4, 2022 |
| Current status | Offline |
On March 21, 2023, BreachForums was shut down following the arrest of its owner, Conor Brian Fitzpatrick.[3] The forum was later reopened under the administration of the hacking group ShinyHunters and former BreachForums administrator "Baphomet". Fitzpatrick was initially sentenced to time served followed by 20 years of supervised release. The site was again shut down and its domains seized on May 15, 2024, before returning online later that month.
BreachForums, along with other cybercrime forums, used DDoS-Guard for web-hosting services.[4] DDoS-Guard has been criticized for hosting websites associated with illicit activities and for its alleged lack of action in response to abuse reports.[5]
History
The forum was founded in March 2022 by then-19-year-old Conor Brian Fitzpatrick, known on the forum by the screen name "pompompurin".[6] His username was based on the Japanese character Pompompurin by Sanrio. A year earlier, Fitzpatrick had claimed responsibility for the 2021 FBI email hack.[7]
Following Fitzpatrick's arrest, control of the forum was transferred to Baphomet and ShinyHunters. In 2024, the user IntelBroker became the forum's new owner after the platform had reportedly stagnated under its previous administration.[8] In 2025, IntelBroker announced that he was stepping down as administrator and transferring ownership to an account named "Anastasia".
ShinyHunters later stated that IntelBroker had acted as a figurehead and returned to publicly operating the website. ShinyHunters also claimed that "Anastasia" was an alternate account operated by the group.[citation needed]
In April 2025, the administrators shut down BreachForums, citing an alleged zero-day vulnerability in MyBB, the software on which the forum operated.[9]
In August 2025, BreachForums went offline again after ShinyHunters claimed that the website had been compromised and was being controlled by international law-enforcement agencies.[10]
In April 2026, ShinyHunters published a message on its data-leak website stating that no official version of BreachForums existed.[citation needed]
Notable leaks
On December 10, 2022, a forum member using the screen name "USDoD" posted a thread offering to sell a database containing information concerning more than 80,000 members of the FBI nonprofit organization and information portal InfraGard. The individual claimed to have accessed the portal through a social-engineering attack in which they impersonated the chief executive of an unidentified American financial corporation.[11]
On March 6, 2023, IntelBroker posted that he was selling data originating from the breach of DC Health Link, a Washington, D.C., health insurance marketplace. On March 9, another member using the screen name "Denfur" posted a thread containing 200 entries and claimed that additional information would be released. The D.C. Health Benefit Exchange Authority later stated that more than 56,000 customers had been affected, while the original forum posts claimed to contain information concerning more than 170,000 customers.[12][13]
On July 23, 2024, the entire database of the original BreachForums was leaked online by a threat actor. The site's founder, Fitzpatrick, allegedly attempted to sell the data after being indicted and while released on bail.[14]
Arrests and shutdowns
On March 15, 2023, Fitzpatrick was arrested in Peekskill, New York, and charged in federal court with conspiracy to commit access-device fraud.[15][6][16]
Following Fitzpatrick's arrest, another administrator using the screen name "Baphomet" took control of the website and its infrastructure. Baphomet shut it down on March 21, 2023, after expressing concerns that its infrastructure had been compromised.[17] Baphomet later reopened the forum with ShinyHunters.[18]
Approximately one month after his arrest, Fitzpatrick was hospitalized following an apparent suicide attempt while released on bail.[19]
He later pleaded guilty to conspiracy to commit access-device fraud, access-device fraud and possession of child sexual abuse material.[20]
In January 2024, Fitzpatrick was detained after violating bail conditions that prohibited him from using a virtual private network.[21]
Despite federal prosecutors requesting a prison sentence of more than 15 years, Fitzpatrick was initially sentenced to time served followed by 20 years of supervised release.[22]
First domain seizure
On June 23, 2023, three months after the forum's shutdown, its clearnet domains were seized by the Federal Bureau of Investigation, the Office of Inspector General of the United States Department of Health and Human Services, and the United States Department of Justice. The seizure was conducted under a warrant issued by the United States District Court for the Eastern District of Virginia.
Second domain seizure
On May 15, 2024, the FBI seized BreachForums' clearnet website, its .onion service and an associated Telegram channel. The seizure followed the publication of data obtained from Europol's portal. According to ShinyHunters, the forum administrator Baphomet was also arrested.[23] The website returned online on May 29, 2024.[24]
2025 suspected MyBB zero-day infiltration
On April 28, 2025, BreachForums administrators published a PGP-signed statement on the forum's landing page, stating that they had taken the website offline earlier that month after trusted contacts allegedly confirmed that law-enforcement agencies had exploited an undisclosed zero-day vulnerability in MyBB to gain covert access.[25][26][27]
The administrators stated that an incident-response review had found no evidence of a data compromise, but that the forum would remain offline while its back end was rewritten. They also warned that recently launched BreachForums clones were likely honeypots and reiterated that no staff members had been arrested.[25][26]
2025 arrests
In February 2025, a suspected BreachForums administrator known as IntelBroker was arrested.[28]
In June 2025, French police announced the arrests of four other suspected BreachForums administrators: Hollow, Noct, Depressed and ShinyHunters.[28] All four were reported to be in their twenties. The FBI's Internet Crime Complaint Center stated that ShinyHunters had operated the website from June 2023 until its shutdown.[28]
At the end of July 2025, two news websites suggested that French authorities may have arrested an affiliate of ShinyHunters rather than the group's principal operator, as the ShinyHunters identity appeared to remain active.[29][30]
2025 shutdown
On August 12, 2025, BreachForums went offline after ShinyHunters claimed that the website had been compromised and was controlled by international law-enforcement agencies.[10]
In a PGP-signed message published on Telegram, ShinyHunters alleged that the forum's infrastructure and official PGP key were in the possession of the French police's cybercrime unit, operating in cooperation with the United States Department of Justice and the FBI. The statement alleged that administrator accounts belonging to Hollow, ShinyHunters and the account known as "Founder" had been seized.[citation needed]
The message further claimed that private messages, plaintext passwords, IP addresses, email addresses and other metadata collected since the forum's July 1 relaunch had been exposed. ShinyHunters also alleged that the forum's source code had been modified to record user activity, effectively converting it into a honeypot intended to identify participants.[citation needed]
Founder's resentencing in 2025
On September 16, 2025, Fitzpatrick was resentenced to three years in federal prison.[31]
The resentencing followed a January 2025 decision by the United States Court of Appeals for the Fourth Circuit, which vacated his initial sentence of 17 days of time served and 20 years of supervised release. The appeals court found the original sentence substantively unreasonable in light of the scale and seriousness of the offenses.[32]
As part of his plea agreement, Fitzpatrick forfeited more than 100 domain names, more than a dozen electronic devices and cryptocurrency derived from the forum's activities. According to the Department of Justice, the original BreachForums hosted more than 14 billion individual records of personal information.[31]
Competing successor forums (2025–2026)
Following the shutdown of a previous version of BreachForums in 2025, several competing platforms claimed to be continuations of the forum. SpyCloud described the resulting rivalry as the "Forum Wars" or "Clone Wars", while ZATAZ characterized the later history of BreachForums as a permanent war of succession in which the authenticity and lineage of the different versions became increasingly difficult to establish.[33][34]
According to SpyCloud, one of these versions was successively accessible through several domain names and was reportedly associated with former members of the BreachForums staff. The company stated that an actor using the pseudonym N/A appeared to have controlled Indra's account while one version of the website operated under the breachforums[.]as domain. N/A was also reported to have controlled older accounts belonging to former administrators or community members, including Caine. SpyCloud nevertheless emphasized that it was unclear who had controlled the different Indra accounts during the dispute.[35] ZATAZ similarly considered the forum's historical continuity to have become disputed beginning with the versions it classified as BF V4.[34]
Following Indra's withdrawal from the administration, under circumstances that were reported inconsistently, an actor using the pseudonym Breach3d reportedly helped maintain the continuity of BreachForums. Breach3d was described as the owner and one of the principal administrators of platforms operating through the breachforums[.]ac and breached[.]rs domains, which he allegedly operated alongside an associate.[citation needed]
The breach3d account was also reported to have been active on versions of BreachForums from December 2025, primarily publishing databases relating to France and several other countries.[citation needed] In April 2026, the pseudonym was associated with a claim of responsibility for a data breach affecting the French Agence nationale des titres sécurisés, also known as France Titres. A 15-year-old suspected by investigators of using the pseudonym was detained on April 25, 2026.[36]
2026 data breach
In January 2026, user data from the website was leaked alongside a manifesto by an actor using the alias "James".[1] The most recent registration date in the leaked database was August 11, 2025, suggesting that the data had been obtained shortly before the August 2025 closure. The leak included information concerning approximately 324,000 user accounts.[1]