Law enforcement in a coordinated 14‑country operation seized LeakBase domains and databases, confiscating user accounts, private messages and IP logs. Authorities executed arrests and searches and say the forum hosted stolen credentials and hacking tools and will support ongoing investigations into buyers and sellers of breached data.

Authorities in a multi‑national operation led by U.S. and Europol investigators took down LeakBase between March 4 and March 6, 2026, seizing forum domains, the underlying database and artifacts including user accounts, private messages and IP logs. Investigators say LeakBase had more than 140,000 registered users and served as a marketplace and discussion hub where stolen credentials, access tools and exploit material circulated. Law enforcement executed targeted arrests and search warrants tied to forum operators and prominent users and collected evidence intended to trace buyers and sellers of breached data and to identify threat actors behind fraud campaigns. Officials emphasized that the seized data will be used to support active prosecutions and intelligence sharing across jurisdictions, enabling follow‑on actions against individuals who purchased or trafficked in stolen information. The takedown was presented as part of a broader effort to disrupt criminal infrastructure used to fuel identity theft, account takeover, financial fraud and other cybercrimes, and to recover evidence for victim remediation and restitution efforts.