As everyone expected, it was only a matter of time before the most recent version of BreachForums was seized, and last night, it happened. This time, though, there is no announcement from ShinyHunters about rebuilding the forum and making it stronger and better than ever. To the contrary, ShinyHunters says they are done with the forum.
In response to the seizure of BreachForums last night, ShinyHunters posted a statement:
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512
Hello,
BreachForums was seized by the FBI and international partners today. This was inevitable and I am not surprised. Neither I and others involved with this group have been arrested. All our BreachForums domains were taken from us by the US Government a few days ago. The era of forums are over.
We have conducted a thorough incident response on the BreachForums infrastructure ever since the domains were taken:
– – BreachForums latest database backup was compromised along with every single database backup since 2023 till now.
– – All escrow databases were compromised ever since it’s release.
– – The backend servers itself were seized and destroyed.
In the simplest terms, we very likely got hacked by the US Government, considering their splash page is up on the BreachForums onion, it’s a clear sign how everything in our control that they wouldn’t have been able to reach is gone.
For your own safety, security, and sanity keep your opsec in check. I have no doubt the FBI and other international partners involved will be cracking down on many individuals in the next coming few weeks to months.
Over the years, BreachForums has undergone significant turbulence. To my count this is the 4th time, including RaidForums seizure that the FBI has took action, consistently. We are not fighting this war anymore, this is officially the end.
To confirm a wild conspiracy theory brought up by multiple individuals and some security researchers over time:
The following is not common knowledge among the general community and public but when RaidForums was seized and BreachForums was launched shortly after, pompompurin was just a front. We all carefully planned the launch of BreachForums since day 1, ever since then everything has went to complete shit because of unforeseen circumstances and situations. Which lead me to coming out publicly in 2023 and owning the forum along with Baphomet, again, unforeseen circumstances lead to the seizure once again in 2024. Now we’re here. Ever since the beginning, nothing good has come from this. BreachForums is never coming back, if it comes back, it should immediately be considered a honeypot.
There is not much to say about this seizure but one thing to note is, the recent action the US Government has took against us, has no impact on our Salesforce campaigns. The fact that our DLS was also hosted on BreachForums clearnet domain and because we planned to re-open the forum to leak the data of companies who have not complied with us when the deadline arrived onto the re-opened BreachForums was likely the cause of todays seizure.
Time to move on, stay tuned for 11:59 PM New York time on 10/10/2025!
Media enquiries: [email protected], [email protected]
– – ShinyHunters / BreachForums Administration Team
—–BEGIN PGP SIGNATURE—–
iQIzBAEBCgAdFiEEH8TQsd7pFLsFtX+r8fG5ilHJibMFAmjoZKcACgkQ8fG5ilHJ
ibM7KxAArFuEeNT04QTTdNSJvkwY5f+hmQv6ktPLxGvH2x1pznMf1PVmDH+spvQQ
I3xeX/MKB6qr1ChECCvar/6Y7OGIu7PX/iz8EkaTHFmPfOLqv8nKWdhRxnPINFIY
oHBLboL/rhX/iLEZA4QBZU2mncNhsR+hdnDJx4x1nVq4J11wR62mRCBVjh+akPeM
jtEdLHfUSJm84zOwR07M6Xpn3Qeo/FWbDYq9B477Yun/MAkzkQXzBSZyUlcdvuvb
5kg+W8xPWOEuJwQRcZWIbaVWf4q7x2I7taOYPvkqKLnf8AGo54WGfICxGAtpsLOA
Kot0aJI7p/ofF5IirYVlQO5ZA/xmeiwSc4C0FLX7YtpKVSueseLcVuU8hIKTALAY
DZ7faXg59+ZzLVHr9wwhDxB18AYx8RCXiQTKqdbC+AYZ27L6G0QTuo7XEBanAC9z
qxmwRukRljwYtDl5PwSfUVgcjl6ueq/mT0KrXVd5RtmHRgit3yq/Yy9zOFeSCX8m
NemDoVIf/6BzLc+xTQqAQ0i+BGXYsx6VzmEOAeWAsLC1pOvymau5zxuFWDuCazb4
tOS4wnL++2xsgpse/g9VkyNzcNAlFTxiqunWrfqIt7NhYGDN17N/yeD+0UQTdsAy
Z53C9JaNVDL8aWHvctA3m9Ed8yd12sYH9kXY3kh6Nt4HFWnBP0A=
=YyrQ
—–END PGP SIGNATURE—–
The End of BreachForums?
Although the leader of ShinyHunters says it’s the end of the forum and it will not be brought back again, that likely will not stop others from trying to open up their own clones of BreachForums. Some clones may be honeypots. Other clones may just people trying to reproduce what BreachForums represented for a while in its heyday.
There have always been those who aspire to be the owner of a popular forum and to earn the admiration of others by being known as the owner of BreachForums. Or perhaps they have dreams of making a lot of money from the forum.
But when the owners have been arrested and charged, we have generally discovered that they never actually amassed a ton of money from owning or running the forum. What they’ve generally amassed is a number of criminal charges and responsibility for paying restitution to victims — even victims that they personally did not hack or attack.
And as DataBreaches reported last night and as ShinyCorp emphasized in his statement, the end of the forum is not the end of the leak site with all of the Salesforce victims. The FBI and DOJ did not respond to inquiries sent by DataBreaches last night, and the onion version of the leak site remains online, presumably with its servers intact. Time will tell, though.