Major data leak forum dismantled in global action against cybercrime forum

[Dave1]

One of the world's largest forum for cyber criminals has been taken down by the FBI and Europol

Code:

leakbase.la

This cyber criminals websites has hundreds of millions of account data and financial information that could include cryptocurrencies that could be used for take over. Or those accounts can be targeted by any groups for their financial gains.



Hopefully this will be permanent dismantling of the group. But again, it's going to be very hard to shut them down as they can go and create a new website again to continue the most, to stole people's information for their profit making purposes.

https://www.europol.europa.eu/media-press/newsroom/news/major-data-leak-forum-dismantled-in-global-action-against-cybercrime-forum

[Yamane_Keto]

Those forums may be a trap to catch or track hackers, as governments create accounts and infiltrate this market. I don't know how serious these services are. Closing them down is usually an indication that governments will create an alternative that they control, and then the users of these services are usually tracked and arrested.

[NeuroticFish]

One of the world's largest forum for cyber criminals has been taken down by the FBI and Europol

I've read - between the lines - some news today about a website related to stolen financial accounts being taken down. I didn't know it was a forum, nor that's the largest one. Well done!

Hopefully this will be permanent dismantling of the group. But again, it's going to be very hard to shut them down as they can go and create a new website again to continue

Most probably it's not going to get down the entire group, but the news I've read were mentioning that some guys were caught and will face criminal charges.
Of course, the news getting to my attention were focusing on the nationality of those caught, not on actually useful info...

[Z-tight]

By December 2025, LeakBase counted more than 142 000 registered users, approximately 32 000 posts and over 215 000 private messages, underlining its scale and global reach.

That's a great number, especially for a service that became active only in 2021. It simply goes to show how big and popular this platform was to cybercriminals, who traded stolen or hacked data in this forum. It is good news it has been dismantled and it took authorities from over 12 countries to do so, that's quite the number.

[hd49728]

Hopefully this will be permanent dismantling of the group. But again, it's going to be very hard to shut them down as they can go and create a new website again to continue the most, to stole people's information for their profit making purposes.

A site is shutdown, seized, a group of hackers arrested won't be the end of the darknet space. They will certainly create new websites, new forums and continue doing similar dark jobs and governments won't be never able to detect, seize all such sites and arrest all hackers.

People must be more educated, knowledgeable about security and have better practice for their account security.

This website is helpful for checking whether an email was in any data breaches before, then take actions with that email and other accounts.
https://haveibeenpwned.com/
[CyberSecurity] Have you ever been pwned? Protect yourself from cyberattacks.

[zasad@]

I sometimes browse darknet sites, and there's a lot of data you can download there completely free of charge. You can also find links to dozens of similar resources there.

I even found my old data there. Everything you transfer to third-party companies for the KYC process will soon be on these sites.

[Z-tight]

A site is shutdown, seized, a group of hackers arrested won't be the end of the darknet space. They will certainly create new websites, new forums and continue doing similar dark jobs and governments won't be never able to detect, seize all such sites and arrest all hackers.

I believe we all know that. There can never be an end to these things, it is just normal. Though that wouldn't stop the authorities from going after them and taking down as many of them as possible.

People must be more educated, knowledgeable about security and have better practice for their account security.

I believe anyone who has ever done kyc shouldn't be surprised if their data is sold in darknet websites like this. And we are talking about 99% of people, because kyc is now more a less a normal thing to everyone, despite how dangerous it can be. However, knowledge is also important to avoid falling for the scams they perpetrate with these stolen data, email phishing is a very popular one.

[Lucius]

~snip~
I believe anyone who has ever done kyc shouldn't be surprised if their data is sold in darknet websites like this. And we are talking about 99% of people, because kyc is now more a less a normal thing to everyone, despite how dangerous it can be. However, knowledge is also important to avoid falling for the scams they perpetrate with these stolen data, email phishing is a very popular one.

Unfortunately, it's true, everyone requires KYC, but very few know how to protect their clients' data. All that is needed is to keep the data offline, and set conditions for access to it that guarantee data security. Instead, most companies behave irresponsibly by giving that job to other companies, which have proven to be completely incapable of protecting the entrusted data.

When I wanted to install my bank's banking app, they asked me for full verification through some other company I've never heard of - which means that the bank is knowingly putting its clients at additional risk because they don't want to do the job themselves. Of course I refused, they didn't tell me that I could also do the verification at the bank.

[PrivacyG]

I sometimes browse darknet sites, and there's a lot of data you can download there completely free of charge. You can also find links to dozens of similar resources there.

I even found my old data there. Everything you transfer to third-party companies for the KYC process will soon be on these sites.

Well.  As long as you sent them your information, you can consider that now belonging to them too.  That is how I see it at least.  It can be shared to other Parties through accidents or by intention, does it even matter?  Even information stored on paper posed some risk, let alone information that can be shared in two clicks.

There can be many 'accidents' that can happen.  You send an explicit picture of your self through Amazon servers.  You do not know if the servers will ever delete that.  It may end up on a storage device sold to a stranger for nothing, 'wiped' in a not Secure way and the stranger may actually have a habit of recovering any recoverable file to leak any interesting information on the internet.  There you go, naked for all the eyes in the World to see.

[yhiaali3]

When I wanted to install my bank's banking app, they asked me for full verification through some other company I've never heard of - which means that the bank is knowingly putting its clients at additional risk because they don't want to do the job themselves. Of course I refused, they didn't tell me that I could also do the verification at the bank.

I don't understand why the bank is requesting full verification from another company. I mean, why doesn't the bank handle this itself? Don't they have the capabilities to do it? This is the worst thing I've ever heard!😠

If we don't trust the bank to protect our sensitive information, how can we trust a third party? It's good that you refused, but can you always refuse? I mean, there are some local services you're forced to use because there are no alternatives, and you're obligated to provide your sensitive data even though you know it's at risk.

[zasad@]

I sometimes browse darknet sites, and there's a lot of data you can download there completely free of charge. You can also find links to dozens of similar resources there.

I even found my old data there. Everything you transfer to third-party companies for the KYC process will soon be on these sites.

Well.  As long as you sent them your information, you can consider that now belonging to them too.  That is how I see it at least.  It can be shared to other Parties through accidents or by intention, does it even matter?  Even information stored on paper posed some risk, let alone information that can be shared in two clicks.

There can be many 'accidents' that can happen.  You send an explicit picture of your self through Amazon servers.  You do not know if the servers will ever delete that.  It may end up on a storage device sold to a stranger for nothing, 'wiped' in a not Secure way and the stranger may actually have a habit of recovering any recoverable file to leak any interesting information on the internet.  There you go, naked for all the eyes in the World to see.

I live in Russia. A Russian citizen can have three passports. One is a local passport, valid only within the country; it's used for all important real estate transactions, banking services, and everything else. I also have two international passports for travel abroad. If the data from one of my internationa passports is stolen by hackers, it won't cause any harm; I'll cancel that passport, and it has an expiration date. But I don't envy people who only have one passport for international travel and all local activities.

[Z-tight]

I don't understand why the bank is requesting full verification from another company. I mean, why doesn't the bank handle this itself? Don't they have the capabilities to do it? This is the worst thing I've ever heard!😠

It happens often, certain companies and institutions outsource to third parties the storage of their own customers data and personal information. There are reasons why they do it (cutting cost, improved data security, etc), but it puts the customer in a situation were they have to completely trust the third party, and it becomes a more difficult choice when you know nothing about the third party storage company used, so yeah.

[Die_empty]

It happens often, certain companies and institutions outsource to third parties the storage of their own customers data and personal information. There are reasons why they do it (cutting cost, improved data security, etc), but it puts the customer in a situation were they have to completely trust the third party, and it becomes a more difficult choice when you know nothing about the third party storage company used, so yeah.

Besides cutting costs, maybe they do it to shift responsibility. Some of them have the financial capacity to manage customers' data, but they prefer to delegate to avoid blame. It is easier for banks to announce that a third party suffered a security breach than to say they are the one that was attacked directly. Customers will easily blame the third-party service providers for the problems instead of the banks. 

[Lucius]

~snip~
If we don't trust the bank to protect our sensitive information, how can we trust a third party? It's good that you refused, but can you always refuse? I mean, there are some local services you're forced to use because there are no alternatives, and you're obligated to provide your sensitive data even though you know it's at risk.

I can always refuse, the consequences of course are that I cannot use the specific service, or that I will have to close my bank account. I used to have accounts in three different banks, today I only have one, and it's not out of the question that I'll close that one too. It especially annoys me when I have to come to the bank and answer strange questions as part of regular checks.

[zasad@]

~snip~
If we don't trust the bank to protect our sensitive information, how can we trust a third party? It's good that you refused, but can you always refuse? I mean, there are some local services you're forced to use because there are no alternatives, and you're obligated to provide your sensitive data even though you know it's at risk.

I can always refuse, the consequences of course are that I cannot use the specific service, or that I will have to close my bank account. I used to have accounts in three different banks, today I only have one, and it's not out of the question that I'll close that one too. It especially annoys me when I have to come to the bank and answer strange questions as part of regular checks.

What are you worried about?
According to general rules, if a bank transfers clients’ personal data to third companies, then either the client must know about it or be notified.
But also your data is in telephone companies, in utility services, in social services, in transport companies.
If it was stolen, it will never leave the Internet.

[Dave1]

Those forums may be a trap to catch or track hackers, as governments create accounts and infiltrate this market. I don't know how serious these services are. Closing them down is usually an indication that governments will create an alternative that they control, and then the users of these services are usually tracked and arrested.

Yes, that's one way that authorities are doing, they are inserting themselves in this community and pretend that they are one of them, just like in real life spy.

Hopefully this will be permanent dismantling of the group. But again, it's going to be very hard to shut them down as they can go and create a new website again to continue

Most probably it's not going to get down the entire group, but the news I've read were mentioning that some guys were caught and will face criminal charges.
Of course, the news getting to my attention were focusing on the nationality of those caught, not on actually useful info...

And most likely when one group is dismantled, another one emerges from the ruin that is more disruptive that the first one. But hopefully this cyber group as going to be caught again and again, so it's a uphill battle for this authorities to continue what they are doing.

[NotATether]

I sometimes browse darknet sites, and there's a lot of data you can download there completely free of charge. You can also find links to dozens of similar resources there.

I even found my old data there. Everything you transfer to third-party companies for the KYC process will soon be on these sites.

I would not be surprised if some Leakbase staff kept a few backups of the database and then relaunch the site on a new domain and server.

One of the other data leak forums re-launched this way after being taken down by the FBI.

So the effect of takedowns by law enforcement are noticeable but relatively minimal.

[Z-tight]

I would not be surprised if some Leakbase staff kept a few backups of the database and then relaunch the site on a new domain and server.

One of the other data leak forums re-launched this way after being taken down by the FBI.

So the effect of takedowns by law enforcement are noticeable but relatively minimal.

I am not exactly sure how these darknet forums are run, but i am certain they must have admins and there is a high chance they would keep backups of their database. In other words, if they were not arrested, they would surely relaunch this service sometime later and it could be the next big data farm forum that would be busted in the future, lol.

That's why i believe arrests are crucial in takedowns, as they could also lead the authorities to further arrests of those who are at large. That way they could be forced to surrender whatever is left of the forum that could be used to relaunch in the future.

[yhiaali3]

~snip~
If we don't trust the bank to protect our sensitive information, how can we trust a third party? It's good that you refused, but can you always refuse? I mean, there are some local services you're forced to use because there are no alternatives, and you're obligated to provide your sensitive data even though you know it's at risk.

I can always refuse, the consequences of course are that I cannot use the specific service, or that I will have to close my bank account. I used to have accounts in three different banks, today I only have one, and it's not out of the question that I'll close that one too. It especially annoys me when I have to come to the bank and answer strange questions as part of regular checks.

What are you worried about?
According to general rules, if a bank transfers clients’ personal data to third companies, then either the client must know about it or be notified.
But also your data is in telephone companies, in utility services, in social services, in transport companies.
If it was stolen, it will never leave the Internet.

The problem isn't the bank legally transferring customer data to external companies, but rather whether these external entities are trustworthy. Will they maintain data security?

The bigger problem, as you mentioned, is that our data is held by telecommunications companies, utility companies, and so on. This is where the danger lies. If any of these services are hacked, this data will end up being sold on the dark web.
This is a real dilemma because you can't use these services without providing your data.

[zasad@]

~snip~
If we don't trust the bank to protect our sensitive information, how can we trust a third party? It's good that you refused, but can you always refuse? I mean, there are some local services you're forced to use because there are no alternatives, and you're obligated to provide your sensitive data even though you know it's at risk.

I can always refuse, the consequences of course are that I cannot use the specific service, or that I will have to close my bank account. I used to have accounts in three different banks, today I only have one, and it's not out of the question that I'll close that one too. It especially annoys me when I have to come to the bank and answer strange questions as part of regular checks.

What are you worried about?
According to general rules, if a bank transfers clients’ personal data to third companies, then either the client must know about it or be notified.
But also your data is in telephone companies, in utility services, in social services, in transport companies.
If it was stolen, it will never leave the Internet.

The problem isn't the bank legally transferring customer data to external companies, but rather whether these external entities are trustworthy. Will they maintain data security?

The bigger problem, as you mentioned, is that our data is held by telecommunications companies, utility companies, and so on. This is where the danger lies. If any of these services are hacked, this data will end up being sold on the dark web.
This is a real dilemma because you can't use these services without providing your data.

I live in Russia. Most of the data of Russians and residents of neighboring countries has long been stolen and can be found through various bots.
You can see an example of this bot: https://sherlok-bot.link/
This is not an advertisement, but rather information about what information will be presented. Everything written there is true; I verified it on similar services.

I can change all my documents, car license plates, address, phone number, and move to the woods or not worry about it. In my country, most of the data has long been stolen. What about yours?

I sometimes browse darknet sites, and there's a lot of data you can download there completely free of charge. You can also find links to dozens of similar resources there.

I even found my old data there. Everything you transfer to third-party companies for the KYC process will soon be on these sites.

I would not be surprised if some Leakbase staff kept a few backups of the database and then relaunch the site on a new domain and server.

One of the other data leak forums re-launched this way after being taken down by the FBI.

So the effect of takedowns by law enforcement are noticeable but relatively minimal.

Unfortunately, this data quickly spreads across similar forums, and in a couple of years it will be made publicly available.