An analysis of the BreachForums leak(s)

BreachForums is a notorious dark web marketplace for stolen data that appeared in 2022. Because the forum has been shut down and rebooted several times, there have been different "leaks" associated with its various iterations. For instance in 2023 the U.S. law enforcement seized and shut down BreachForums, as well as arresting its administrator, Conor Brian Fitzpatrick, also known as Pompompurin. BreachForums relaunched, but it was seized and shut down again in 2024 by FBI. The most significant and recent leak occurred in early January 2026, exposing the identities and metadata of potentially hundreds of thousands of forum users.

Based on existing information, the new leaked data appears legitimate; for instance, several "research" accounts used by security researchers to keep tabs on cybercriminals appear in the dump — with what appears to be correct information-such as e-mail or password hash.

However, it also appears that some fields have been "cleaned", perhaps for OPSEC reasons. Please take this information with a grain of salt.

Name: breachedforum.7z

SHA256: 0de77ac6dedf12ad97417a19fcde2bdd2664cab3785318b9e734dce8620471c2

1. The January 2026 Database Leak

On January 9, 2026, a database containing the records of BreachForums users was leaked online. This leak is considered "doomsday" for many forum members because it provides law enforcement with a roadmap to identify active cybercriminals.

The leak was posted on a site associated with ShinyHunters, a well-known hacking collective that had previously administered the forum, although it's unclear who posted it: law enforcement or the hacking collective themselves.

• Scale: The database contains SQL INSERT's for 323,986 rows.
• Usernames and Email Addresses: A bit over 670,000 email addresses can be found across all tables.
• IP Addresses: While some records were modified (using loopback addresses like 127.0.0.9, as an OPSEC measure?), many authentic IP addresses remained.
• Password Hashes: Passwords were stored as Argon2 hashes. These would be very computing intensive to crack, for instance, the Argon2 setup parameters require a 65MB memory buffer for computation.
• Cause: Some believe the data was obtained through a vulnerability in the forum's CMS (MyBB) or a server misconfiguration, but no real information is available about the hack.

2. The 2024 "v1" Leak

In July 2024, a separate leak occurred involving the original version of BreachForums (v1), which was run by the founder Conor Brian Fitzpatrick (alias "Pompompurin").

• Scope: This leak exposed roughly 212,000 member records.
• Origin: The data reportedly came from a November 2022 backup that Fitzpatrick had stored on a MEGA account. A threat actor named "Emo" allegedly obtained and released this database after Fitzpatrick was arrested.

3. Law Enforcement Seizures & "Honeypot" Risks

Beyond accidental leaks, BreachForums has been subject to multiple law enforcement operations that effectively "leaked" user data to the authorities:

• May 2024: The FBI and international partners seized the forum's domains and backend infrastructure. They gained access to the site's database, including logs that could be used to de-anonymize users.
• October 2025: Law enforcement seized the breachforums[.]hn domain, which had transitioned from a forum into a dedicated extortion portal for a Salesforce data theft campaign.
• The "Honeypot" Warning: Following these seizures, the admins themselves warned that any new versions of BreachForums might be "honeypots" — sites controlled by law enforcement to gather intelligence on hackers.

Impact of this leak

1. De-anonymization: The primary impact is the exposure of hackers' real-world identities. By cross-referencing leaked emails and IP addresses with other data breaches, law enforcement can track down individuals who previously thought they were anonymous.
2. Internal Distrust: The fact that the site was breached — likely by its own former associates or through a simple software flaw — might cause a collapse in trust within the cybercriminal community.
3. End of an Era: Following the January 2026 leak and repeated FBI takedowns, prominent members like those in ShinyHunters have declared that "the era of forums is over," suggesting that large, centralized dark web marketplaces are now too dangerous for high-level cybercrime.

IP Whois analysis

The IPs in the forum data include two fields — account registration IP and last login IP. The WHOIS data for these IPs includes several entries of interest, ranging from high-security military and government organizations to specialized technology and infrastructure companies. Below is a analysis of the most notable IPs based on their registered organizations.

1. Government and Military Organizations

These IPs are particularly significant as they belong to national defense and central government administrative bodies.

• Royal Armed Force Headquarters (Country in Asia): A significant number of IPs are registered to the country's military central command.
• Ministry of Commerce (Country in Middle East): One IP is registered directly to this government ministry.
• Ministry of Education (European country): One IP is registered with a Ministry of Education and Research in a country in Europe.
• Department of Education (North America country): One IP is registered to this country's provincial government department.
• Municipal Government (North America country): One IP belongs to the municipal government.

2. Research, Academic, and Educational Institutions

Institutions of higher learning and research-focused entities often have unique network footprints.

• Dakota State University (USA): Several IPs, including 138.247.104.124 and 138.247.253.1, are registered to this university.
• University of San Francisco (USA): IP 138.202.26.62 is registered to this academic institution.
• Texas Christian University (USA): IP 138.237.15.70 is associated with this university.
• Consortium GARR (Italy): IP 192.167.204.125 belongs to Italy's national computer network for universities and research.
• Renater (France): IPs 194.57.107.121 and 194.57.107.122 are registered to the French national telecommunications network for technology, education, and research.

3. Unusual and Infrastructure-Specific IPs

These IPs are notable for their connection to space exploration, specialized cloud services, or high-security telecommunications.

• Space Exploration Technologies Corporation (SpaceX/Starlink): A range of IPs is registered to SpaceX, likely for Starlink satellite ground stations or infrastructure15. Notable IPs include:
• 102.215.57.127, 102.215.57.157, and 102.215.57.244
• 1337 Services GmbH (Germany): IPs like 194.26.192.142 and 194.26.192.61 are registered to this provider, often associated with specialized privacy-focused hosting.
• UCLOUD Information Technology (Hong Kong): IP 107.155.15.131 belongs to this cloud provider specialized in AI and high-performance computing infrastructure.
• Akamai Technologies: Numerous IPs are registered to this global Content Delivery Network (CDN), such as 172.104.85.154 and 172.235.53.137
• HUAWEI International (Hong Kong): A significant block of IPs (e.g., 101.44.80.101, 101.46.4.108) is registered to Huawei's international arm.

Here's how this looks distributed by country:

Perhaps unsurprising to see Romania in position 7, although it seems many of the IPs are VPNs.

How about the scrubbed addresses?

Some indications point to the fact that administrators used automated scripts to execute "UPDATE" commands on specific tables — primarily the users and sessions tables—replacing legitimate connection data with placeholder "zeroed out" values like 0.0.0.0 127.0.0.9or other loopback addresses. This process was likely not a sitewide sweep, but may have been a targeted intervention designed to safeguard the identities of the "inner circle," including staff members and top-tier contributors, before the data was either seized by law enforcement or leaked to the public. By isolating these accounts and neutralizing their IP history, the administrators attempted to break the digital trail that would otherwise lead investigators from a public pseudonym to a specific physical location or ISP subscription.