BreachForums launched in March 2022 to replace the seized RaidForums. Law enforcement shut it down in March 2023, and it went offline again in May 2024. According to the US Department of Justice, its founder was resentenced to three years in prison on 16 September 2025. DarkForums is one of the successor forums; as of October 2026 we found no official announcement of action against it.
What was RaidForums?
RaidForums was an English-language underground forum where members bought, sold and traded stolen data. According to a 2022 US indictment, its chief administrator ran it from January 2015 to 31 January 2022. The indictment says members could join free or pay for one of three paid tiers, buy “credits” to open paid areas, and use a fee-based “Official Middleman Service” for deals.
In 2026 the US Department of Justice referred to the “disruption of predecessor cybercrime marketplaces RaidForums in 2022 and BreachForums in 2023”. The 2022 indictment against the administrator contains six counts, including conspiracy, access device fraud and aggravated identity theft.
What happened to BreachForums?
The US Department of Justice says BreachForums launched in March 2022 as a replacement for the seized RaidForums. In 2025 it said the forum grew to more than 330,000 members and hosted at least 888 datasets of stolen information with over 14 billion individual records.
In March 2023 the founder was arrested and the forum was shut down. A 2023 US case page said BreachForums claimed more than 340,000 members, and listed a post offering the details of about 200 million users of a major social network. A second version launched in June 2023. According to a 2025 court complaint, it went offline on or about 15 May 2024 and relaunched on or about 29 May 2024.
The founder’s case went on for years. The US Court of Appeals for the Fourth Circuit vacated his original sentence of time served (17 days) on 21 January 2025, and he was resentenced to three years in prison on 16 September 2025, with more than 100 domain names forfeited.
The same 2025 complaint charged a UK national, known online as IntelBroker, with computer intrusion and wire fraud offenses linked to selling stolen data. According to the complaint, that account was shown as the forum’s owner from about August 2024 to January 2025. The complaint is an allegation, not a verdict.
Why did it keep coming back?
A forum is software, a name and a community. Law enforcement can seize domains and servers, but the people and their reputation scores can move to a new site within days. The court complaint above shows this pattern: the 2022 launch, the 2023 shutdown, the June 2023 relaunch and the May 2024 return all happened within about two years.
Sellers also want a place with buyers, so a known name draws the next version. According to a news report on the October 2025 seizure notice, which showed the logos of the FBI, the Department of Justice and two French units, the group behind the site said it would still go ahead with a planned data leak. That is a claim by the group, not an official finding.
What is DarkForums?
DarkForums is a forum that security vendors describe as a successor to BreachForums, where stolen databases and access are offered. We did not find an official source (court filing, press release or advisory) that describes DarkForums, its operators or any action against it, so we do not give details about who runs it. As of October 2026, we found no announced seizure or charges naming it.
The wider picture is that more forums have appeared and some were taken down. On 4 March 2026 the Department of Justice announced the takedown of LeakBase, a forum with more than 142,000 members, in an operation across 14 countries, and linked it to the earlier RaidForums and BreachForums actions. Our guide Hacker and Leak Forums 101 explains how these places work, and a law enforcement takedown rarely ends the activity itself.
- 2015 to January 2022RaidForums run by its chief administratorPeriod named in the 2022 US indictment.
- 2022RaidForums disruptedNamed by the US Department of Justice as a disruption in 2022.
- March 2022BreachForums launchesDescribed by the Department of Justice as a replacement for the seized RaidForums.
- 15 March 2023Founder arrestedA US court complaint names the founder; the forum is shut down in March 2023.
- June 2023Second version of the forumLaunched after the March 2023 shutdown, per a 2025 court complaint.
- 15 May 2024Forum goes offlineBack online on or about 29 May 2024, per the same complaint.
- 21 January 2025Appeals court vacates founder’s sentenceThe Fourth Circuit sends the case back for resentencing.
- February 2025Complaint against a UK nationalCharges linked to data sales on the forum; filed in New York.
- 16 September 2025Founder resentencedThree years in prison, according to the Department of Justice.
- October 2025Seizure notice on the forum domainsShowed US and French agency logos, according to a news report.
- 4 March 2026LeakBase dismantledUS announcement ties it to the RaidForums and BreachForums actions.
- October 2026No official action found against DarkForumsOur check of official sources.
What does it mean for defenders?
A takedown does not delete the stolen data. Copies stay in private hands, and listings can reappear on another forum under a new name. For a security team the useful question is whether your own data, staff accounts or customer records appear on any such forum, and how fast you hear about it. Dark web monitoring covers that, and a data leak site is often where a claim first shows up.
Many listings come from an initial access broker who sells a way into a network rather than data. For background, see our posts on dark web marketplaces and how the dark web works and what is legal.
- Treat a forum claim as a leadCheck whether the data is real and yours before anyone reacts.
- Watch for your names and domainsTrack brand, domain and staff email mentions, not forum names, because names change.
- Reset what is exposedChange passwords, end sessions and rotate keys for any account in the claim.
- Plan for the forum to moveKeep the same watch list after a takedown, as listings often reappear elsewhere.
- Brief leaders with dated factsSay what is confirmed, what is claimed and what is unknown.
Sources
The US Department of Justice, Eastern District of Virginia, published the second superseding indictment against the RaidForums administrator in 2022 (indictment). The same office published the 2023 case page for the BreachForums founder (case page). The Department of Justice announced the resentencing in 2025 (press release) and the LeakBase takedown in 2026 (press release). The US Attorney’s Office for the Southern District of New York filed the 2025 complaint (complaint). The October 2025 seizure notice is described in a news report (The Record, 2025).
Last checked against sources: 10 October 2026.