low threat
other
Telecom
✓ Verified
FTP Safaricom Unlimited Internet Access
Published: 16 Mar 2026 10:02 UTC
Indexed: 16 Mar 2026 09:34 UTC
Author:
Guruty
Source:
LeakBase
↗
forum
LeakBase was an underground cybercrime forum and marketplace focused on the distribution, sale, and exchange of stolen data, breached databases, and compromised credentials. The platform operated primarily on the open web and was accessible without special anonymity tools, which contributed to its rapid growth and large international user base.
The forum specialized in publishing and trading large collections of compromised information, including email-password combinations, financial records, banking data, and “stealer logs” harvested by infostealer malware from infected devices. These datasets were often used for account takeovers, fraud schemes, and further cyber intrusions.
LeakBase functioned as both a discussion forum and a structured marketplace. Users could buy or sell stolen databases, hacking tools, and other illicit digital assets using a credit-based internal economy and reputation system designed to establish trust between participants.
The platform was active since 2021 and quickly became one of the larger cybercrime communities operating on the clear web. By late 2025, the forum had accumulated more than 142,000 registered users, approximately 32,000 posts, and over 215,000 private messages, indicating a large and active underground ecosystem built around stolen data.
In March 2026, LeakBase was dismantled during a coordinated international law-enforcement operation involving agencies from multiple countries, including the United States, United Kingdom, and several EU states. Authorities seized the forum’s domains and database, conducted arrests, and collected forensic evidence such as user accounts, private messages, and IP logs to identify individuals involved in cybercrime activities.
The takedown highlighted the role of LeakBase as a significant hub in the global cybercrime ecosystem and demonstrated increasing cooperation between international law-enforcement agencies targeting platforms that facilitate the trade of stolen digital information.
Description Locked
Sign in and subscribe to any paid plan (Scout or higher) to read leak descriptions and reports.
Full Intelligence Report Requires Access
View complete leak details, descriptions, IOC pivoting, actor attribution, and AI-generated analysis. Sign in or create a free account to continue.