Breachforums

It operated on the clear web (via .st, .cx, .is domains) and a Tor mirror.

Despite being a hub for selling stolen data, BreachForums has repeatedly failed to secure its own data: January 2026 Leak: A database containing roughly 324,000 records BreachForums

: The forum quickly grew to over 330,000 members, offering access to more than 14 billion individual records of personally identifying information (PII) across hundreds of datasets. Law Enforcement Actions : It operated on the clear web (via

: The FBI and DOJ have seized various BreachForums domains and Telegram channels multiple times. In May 2024, law enforcement reportedly arrested "Baphomet". In May 2024, law enforcement reportedly arrested "Baphomet"

In May 2024, threat actors posted a massive cache of data allegedly belonging to 560 million Ticketmaster customers. The listing included 1.3 terabytes of data, featuring credit card numbers and ticket sales details, with an asking price of $500,000.

The legacy of BreachForums extends far beyond its own code and servers. It served as a primary driver of the modern data breach economy, where the personal information of hundreds of millions of people was commodified on an industrial scale. The credentials sold on its marketplace were weaponized in real time by other threat actors to launch credential-stuffing attacks, financial fraud campaigns, and account takeover schemes. The site was a crucial nerve center for monetizing corporate vulnerabilities, serving as the primary exchange for everything from raw database dumps to initial access to compromised corporate networks.

BreachForums were a series of online marketplaces that operated on the dark web, accessible only through specialized software such as Tor. These forums allowed users to buy, sell, and trade stolen data, including personal identifiable information (PII), credit card numbers, and login credentials. The marketplaces were created to provide a platform for cybercriminals to monetize their illicit activities, making it easier for them to obtain and trade stolen data.