FBI, French Authorities Dismantle Online Market for Hacked Data

The Federal Bureau of Investigation (FBI) and French authorities seized a prominent domain used by cyber criminals to traffic stolen data and threaten their victims with extortion. 

The domain known as BreachForums was taken down by law enforcement. Anyone visiting Breachforums today will be greeted with the message that the domain has been seized.

The online marketplace was used by various hacking groups including ShinyHunters, Baphomet, and IntelBroker to “traffic stolen data and facilitate extortion.” Those three groups combined to a form a new group known as Scattered Lapsus$ Hunters. 

According to an FBI post, “This takedown removes access to a key hub used by these actors to monetize intrusions, recruit collaborators, and target victims across multiple sectors.”

The Scattered Lapsus$ Hunters were believed to be behind the cyber-attacks that stole information from Salesforce customers. Companies like Toyota, Disney, Marriott, Google, and others were impacted. 

This is the third time the FBI has taken down Breachforums. It was first taken down in March 2023 following the arrest of its founder, Conor Brian Fitzpatrick. It was also taken down in 2024 in a joint operation with Europol. However, successor sites soon popped up. 

And the same thing could be happening this time. The threat actors claim that their website on the Tor Dark Web is still accessible and will be used to leak data related to the Salesforce breach. 

Still, cyber experts say the repeated take down of sites like Breachforums, is weakening its effectiveness. 

“Each takedown makes these communities more fragile and less trusted, and the logistics of keeping a large, centralized platform online under constant law enforcement scrutiny have become unsustainable,” said AppOmni Chief Security Officer Cory Michal. 

Salesforce also told clients that it will not pay hackers over the extortion attempts.