Five Hackers Behind Infamous Data-Selling Platform BreachForums Arrested

French cybercrime police have dismantled the leadership of BreachForums, the world’s largest English-language cybercrime forum for trading stolen data, arresting five French nationals accused of operating the platform.

The Brigade de Lutte contre la Cybercriminalité (BL2C) of the Paris Police Headquarters executed synchronized raids across Hauts-de-Seine, Seine-Maritime, and Réunion on June 23, 2025, apprehending four hackers operating under the aliases “ShinyHunters,” “Hollow,” “Noct,” and “Depressed.”

A fifth individual, “IntelBroker,” was arrested in February 2025 and remains in French custody.

Technical Infrastructure and Modus Operandi

BreachForums functioned as a clearnet marketplace (publicly accessible via standard browsers) where threat actors traded stolen databases, hacking tools, network access credentials, and illicit cybercrime services.

Operating as a cybercrime-as-a-service (CaaS) hub, it facilitated transactions using cryptocurrency to anonymize payments.

The forum’s architecture relied on MyBB forum software, which became its Achilles’ heel when a zero-day vulnerability in MyBB led to its compromise in April 2024.

Administrators used Telegram channels for backup communication, but law enforcement seized these channels during the operation.

High-Profile Breaches and Global Impact

The arrested operators are linked to catastrophic data breaches affecting millions globally:

• ShinyHunters orchestrated attacks against Snowflake, compromising Santander, Ticketmaster, and AT&T, and leaked 533 million Facebook user records.
• IntelBroker breached Europol, DC Health Link (exposing U.S. Congress members’ health data), AMD, and Hewlett Packard Enterprise.
• In France, they targeted retail giant Boulanger, telecom provider SFR, employment agency France Travail (43 million records), and the French Football Federation.

Forensic Fallout and Ongoing Investigations

French authorities seized critical digital forensics evidence, including servers and communication logs, expected to unravel additional breaches.

The arrests disrupt a data exfiltration pipeline responsible for:

1. DDoS attacks overwhelming victim networks
2. Exploitation of unpatched vulnerabilities for initial access
3. Monetization via dark web channels
   U.S. and U.K. agencies collaborated, with the FBI issuing a public form to gather victim impact data.
4. The forum’s shutdown leaves a void in cybercriminal ecosystems, though analysts warn of potential migration to smaller, encrypted platforms.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates

The post Five Hackers Behind Infamous Data-Selling Platform BreachForums Arrested appeared first on Cyber Security News.