Contextual Metadata
Remediation Guidance (auto-generated checklist)
Search & Correlation Tools
Access Controls & Ethical Safeguards
Verification Workflow
To understand BreachForums, one must first understand the void it filled. In 2022, the FBI and international law enforcement agencies executed "Operation Tourniquet," seizing the infrastructure of RaidForums, a platform responsible for leaking data from over 3.2 billion user accounts. BreachForums
Enter a user known as "Pompompurin." Just weeks after RaidForums fell, Pompompurin launched BreachForums (previously known as Breached). The platform was not just a clone; it was an upgrade. It boasted faster servers, a user-friendly interface (rare for the Dark Web), and a strict "mirror" system for verifying data leaks.
Unlike anonymous drug markets, BreachForums specialized in information. This included:
March 2025 — In the underground economy of stolen data, few names carry as much weight—or as much legal baggage—as BreachForums.
Just months after the FBI and international partners dismantled the original platform for the second time, security researchers are tracking yet another resurrection of the notorious hacking forum. This whack-a-mole cycle has turned BreachForums into a case study for law enforcement's struggle to permanently erase cybercrime infrastructure from the dark web.
If you want, I can:
BreachForums is a notorious cybercrime marketplace that serves as a primary hub for buying, selling, and trading stolen databases and hacking tools
. It emerged in 2022 as a successor to the seized RaidForums and has since undergone multiple iterations due to law enforcement takedowns and internal conflicts. Department of Justice (.gov) Operational History
Flash Report: BreachForums Allegedly Relaunched With New Domain
Key Findings * On April 23, 2025, ZeroFox observed an announcement posted to the allegedly relaunched BreachForums site, breached[ BreachForums/Raidforums Reporting Form: Form
BreachForums is a notorious English-language cybercrime forum and marketplace primarily used for buying, selling, and trading stolen data. Since its inception in March 2022, it has served as a central hub for threat actors, initial access brokers, and ransomware operators. Historical Overview Contextual Metadata
Origin: Launched in March 2022 by an individual known as "pompompurin" (Conor Brian Fitzpatrick), it was designed as a successor to RaidForums, which had been seized by law enforcement earlier that year.
Expansion: The forum quickly grew to over 330,000 members, offering access to more than 14 billion individual records of personally identifying information (PII) across hundreds of datasets. Law Enforcement Actions:
2023: The forum’s creator, Conor Fitzpatrick, was arrested in March 2023. This led to a temporary closure and a leadership transition to an administrator known as "Baphomet".
2024-2025: The FBI and DOJ have seized various BreachForums domains and Telegram channels multiple times. In May 2024, law enforcement reportedly arrested "Baphomet".
Ongoing Presence: Despite these seizures, new iterations of the forum have frequently reappeared under different administrators, such as "ShinyHunters" and "Hasan". Primary Activities Remediation Guidance (auto-generated checklist)