Authorities in Russia have arrested a suspect believed to be behind LeakBase, a prominent cybercrime forum known for facilitating the trade of stolen data and hacking tools.
The arrest took place in the Rostov region, where law enforcement detained a resident of Taganrog. According to TASS, the unnamed individual is suspected of both owning and operating the LeakBase platform. Irina Volk confirmed the arrest, stating that the suspect is also accused of creating the forum.
LeakBase first emerged in 2021, reportedly backed by the ARES threat group. It quickly expanded, reaching over 142,000 users after the shutdown of the Breached forum in March 2023.
The platform allowed free registration and became a hub for cybercriminal activity. Users traded stolen databases, leaked information, exploits, and hacking services. It also hosted discussions on programming, social engineering, cryptography, operational security, and other technical topics.
In March 2026, LeakBase was dismantled as part of an international law enforcement effort known as Operation Leak. The operation was coordinated by Europol and involved the Federal Bureau of Investigation along with agencies from 14 other countries.
Authorities conducted raids, interviews, and arrests across multiple regions, including the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. In total, around 100 enforcement actions were carried out globally, targeting at least 37 of the platform’s most active users.
The LeakBase website has since been seized and now displays a notice from the FBI. The message states that the site has been taken down as part of an international investigation and warns that its database—including private messages and IP logs—will be used as evidence in ongoing and future cases.
This takedown highlights how global cooperation is becoming more effective in combating cybercrime networks. Forums like LeakBase thrive on anonymity, but coordinated actions like Operation Leak show that law enforcement can still track and disrupt these platforms. It will be interesting to see how this impacts the broader cybercrime ecosystem moving forward.