FBI and Europol Shut Down LeakBase, a Major Market for Stolen Credentials
Law enforcement agencies working together have taken down LeakBase, an influential online marketplace where cybercriminals traded pilfered data and offensive cyber tools. Authorities say the platform ranked among the largest forums facilitating the sale of stolen information.
According to the U.S. Department of Justice, LeakBase had more than 142,000 registered members and hosted more than 215,000 member posts as of December 2025. Visitors attempting to reach the forum at leakbase[.]la are now met with a seizure notice indicating the site was seized by the U.S. Federal Bureau of Investigation as part of an international enforcement action.
The seizure notice informs the public that the site’s data - including user profiles, threads, payment records, private communications, and IP logging information - has been secured and retained to support ongoing investigations.
Accessible in English over the clearnet, LeakBase advertised hacked databases and massive troves of credentials. Investigators report the marketplace offered hundreds of millions of account credentials along with sensitive financial data such as credit and debit card numbers, bank account and routing details, usernames, and associated passwords that could be leveraged to carry out account takeovers and other financial crimes.
The forum experienced downtime recently, and its primary operator, Chucky, was seeking a new hosting provider. Other individuals identified as administrators or moderators on LeakBase included users known as BloodyMery, OrderCheck and TSR.
The disruption effort, carried out under the name Operation Leak on March 3 and 4, 2026, involved executing search warrants, making arrests, and conducting interviews across several countries: the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.
In a coordinated statement, Europol explained that LeakBase specialized in selling “stealer logs” - aggregated archives of credentials harvested by infostealer malware. Those logs provide data attackers can weaponize to commit account takeovers, fraud and a range of other cyber intrusions.
Europol said roughly 100 enforcement actions were carried out globally in connection with the takedown, and authorities took unspecified measures targeting 37 of the forum’s most active users.
Assistant Director Brett Leatherman of the FBI’s Cyber Division described the operation as a coordinated effort by the FBI, Europol and international partners to dismantle one of the largest cybercriminal platforms, noting that investigators have seized member accounts, posts, payment information, private messages and IP records to preserve evidence for prosecutions and further inquiries.