Hacker And Leak Forums 101.

A hacker forum, also called a hacking forum, is an online community where cybercriminals advertise, buy and sell products and services, and share expertise. Europol describes the criminal underground as relying extensively on websites and forums, which it calls market places and hubs where supply and demand meet. Our glossary entry on the underground forum covers the term in short form.

A leak forum is the same idea with a narrower focus. Its members post, sell or trade stolen databases, so it works as a market for breached data. The US Federal Bureau of Investigation (FBI) uses the words hacking forums for RaidForums and BreachForums, which it describes as places where stolen access, breached databases and hacking tools were traded.

Forums are not the same as a data leak site. A forum is a shared community where many members talk and trade. A leak site is a page run by one criminal group to post data stolen from its own victims.

The US Department of Justice (DOJ) lists what was traded on BreachForums in its 2023 case: bank account information, social security numbers, other personal data, hacking tools, breached databases, services for gaining unauthorized access to victim systems, and login details for compromised accounts.

The DOJ said of Cracked, a forum taken down in January 2025, that it sold stolen login credentials, hacking tools and servers for hosting malware and stolen data. For RaidForums, the DOJ said members offered hundreds of databases with more than 10 billion unique records.

Access to company networks

Some listings do not sell data at all. They sell a way into a network. People who sell that entry are called initial access brokers, and the buyer is often a ransomware group. Our post on the anatomy of an access listing shows what such an advert looks like, and the economics are covered in the economic dynamics of data trade.

Most forums run on a few shared habits that build trust between people who cannot trust each other. Europol’s 2014 threat assessment describes them, and the same traits show up in later cases.

• Reputation. Europol says a user’s reputation, and so their online nickname, is one of the most important factors in creating trust and deciding whether to do business.
• Entry rules. More security-conscious forums often require new members to be vouched for by existing members.
• Moderators. Each subforum is generally overseen by one or more moderators, trusted people who manage content and disputes. Europol adds that a rigid hierarchy often exists.
• Vendor review. Vendor status typically requires giving samples to moderators, and products are then rated by customers.

Some members are brokers who sell access instead of data. They use the same reputation system to win buyers, which is why a forum post can be an early sign that a company is about to be attacked. Cybercrime sold as a service is described in our post on cybercrime as a service.

Police take a forum down by seizing its domains and servers and by arresting the people who run it. The glossary entry on a law enforcement takedown explains the method. The record below uses only official announcements from the US Department of Justice, the FBI and Europol.

The FBI describes the chain. RaidForums ran until February 2022, a first BreachForums followed from March 2022 until March 2023, and a second BreachForums ran from June 2023 until May 2024. A seizure removes one site and its operator, but the buyers and sellers still exist, so a new site tends to fill the gap. A takedown is one part of a wider defense, not an end to the market. Our post on the BreachForums and DarkForums succession timeline follows these relaunches in more detail.

Forums live in both places. The FBI describes the second BreachForums as a clear-net marketplace, meaning it could be reached with an ordinary browser. Other forums sit on Tor, part of the dark web that needs special software to reach. Dread, a name many people search for, is a discussion forum on Tor.

A forum is a type of community, not a type of address. The same forum can move between the two, and the lists in our posts on dark web marketplaces and dark web sites and search engines show how often addresses change. If you are asking how people reach the dark web at all, see how to access the dark web, which also covers safety and the law.

Defenders watch forums because the first sign of an attack can appear there. A post that offers your staff logins, your database or access to your network gives you time to act before the data is used. A forum mention is a lead to check, not proof, so each one needs verifying.

Our how-to pages on responding to initial access listings and responding to ransomware leak site listings go step by step. Never interact with sellers or pay for data; leave contact to law enforcement and your legal team.

Brandefense DarkWeb Monitoring follows forums, leak sites and marketplaces for your company name, domains and accounts, so a team does not have to search them by hand.

• Europol, Internet Organised Crime Threat Assessment 2014: forums, reputation, vouching, moderators.
• US Department of Justice, 2022: seizure of RaidForums and charges against its founder.
• US Department of Justice, 2023: the BreachForums case, arrest and what was traded.
• US Department of Justice, 2025: resentencing of the BreachForums founder.
• US Department of Justice, 2025: Cracked and Nulled disrupted.
• Europol, 2025: the same operation, with user counts.
• Europol, 2025: arrest of the XSS administrator.
• US Department of Justice, 2026 and Europol, 2026: LeakBase.
• FBI Internet Crime Complaint Center: the FBI’s account of RaidForums and both BreachForums versions.