Infamous BreachForums forum breached, spilling data on 325K users
- Reference: 1768223228
- News link: https://www.theregister.co.uk/2026/01/12/breachforums_breach/
- Source link:
The latest incarnation of the notorious hacking forum was burgled in August 2025, exposing email addresses, usernames, and hashed passwords, according to Have I Been Pwned, which added the incident to its database on January 10.
The allegedly stolen user data was later posted to shinyhunte[.]rs, alongside a message from a self-described cyber outlaw calling himself "James," who appeared keen to make sure his handiwork didn't go unnoticed.
[1]
[2]Have I Been Pwned's listing of the incident shows that the breach occurred before law enforcement's October 2025 takedown of the BreachForums domain, and that the leak comprised roughly 324,000 unique email addresses, usernames, and Argon2-hashed passwords, pulled from public posts, private messages, and other forum records.
[3]
[4]
According to [5]Resecurity's analysis of the breach , the leaked database includes records linked to real individuals active in the cybercrime world, including crims previously associated with groups such as GnosticPlayers. PGP keys tied to accounts using handles such as ShinyHunters and IntelBroker were also found in the dump.
The database was published alongside a rambling, self-indulgent manifesto by "James," which included remarks and identifiers pointing to other miscreants allegedly involved in malicious activity. Some entries appear to have been edited, partially scrubbed, or tampered with, but Resecurity said a significant chunk of the material appears to be authentic.
[6]
One detail that caught researchers' attention was timing. The most recent registration date in the leaked database is August 11, 2025, the same day the previous BreachForums site at breachforums[.]hn was shut down, suggesting the data was lifted as the forum was entering its final hours.
Resecurity said it reviewed the IP data in the leak, while warning that VPN use muddies the picture. Even so, the records indicate heavy use from the US and parts of Europe, alongside activity in the Middle East and North Africa, including Morocco, Jordan, and Egypt.
The security biz warned that publishing the data could carry real consequences for those named. "Following the publication of this data, undoubtedly many threat actors will face difficulties in hiding their identities and an increased risk of getting arrested," the company said.
[7]
The leak also prompted a rare public response from BreachForums' current administrator, who goes by the alias N/A. In a forum post, the admin apologized for the exposure while insisting the data itself was not new.
[8]Huntress's 'hilarious' attacker surveillance splits infosec community
[9]Death, torture, and amputation: How cybercrime shook the world in 2025
[10]From video games to cyber defense: If you don't think like a hacker, you won't win
[11]QR codes a powerful new phishing weapon in hands of Pyongyang cyberspies
"We want to address recent discussions regarding an alleged database leak and clearly explain what happened," N/A wrote. "First of all, this is not a recent incident. The data in question originates from an old users-table leak dating back to August 2025, during the period when BreachForums was being restored/recovered from the .hn domain."
According to the administrator, the problem stemmed from sloppy handling during the forum's recovery. "During the restoration process, the users table and the forum PGP key were temporarily stored in an unsecured folder for a very short period of time. Our investigation shows that the folder was downloaded only once during that window," N/A added.
The admin also suggested that "James" may be linked to the ShinyHunters collective – a claim that has not been independently verified.
Details that once sat inside a semi-private forum can now be picked and cross-referenced – and for anyone named in the leak, that's a very different problem from an old forum backup quietly gathering dust on a server. ®
Get our [12]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aWUorRDWmm5mFOdf0fy86wAAA44&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://haveibeenpwned.com/Breach/BreachForums2025
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWUorRDWmm5mFOdf0fy86wAAA44&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWUorRDWmm5mFOdf0fy86wAAA44&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.resecurity.com/blog/article/doomsday-for-cybercriminals-data-breach-of-major-dark-web-foru
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aWUorRDWmm5mFOdf0fy86wAAA44&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aWUorRDWmm5mFOdf0fy86wAAA44&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/09/12/huntress_attacker_surveillance/
[9] https://www.theregister.com/2025/12/28/death_torture_and_amputation_how/
[10] https://www.theregister.com/2025/12/26/video_game_hacker_turned_ceo/
[11] https://www.theregister.com/2026/01/09/pyongyangs_cyberspies_are_turning_qr/
[12] https://whitepapers.theregister.com/
And even more security professionals will be exposed.
Ah.
Ahah
Hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha*breathes*hahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahahaha
No honor among thieves
[1]an oldie, but a goodie
[1] https://www.enworld.org/media/dmg_there_is_no_honor_among_thieves-png.49897/
Not a recent incident
Ah, I barely remember it. The dimly forgotten past when this was all fields as far as the eye could see, when children respected their elders, when a man wasn't a man until he owned a good tailored suit and a bowler. The heady late summer of 2025, rapidly fading from living memory. Them were the days.
Kiddies
Wouldn't be a surprise for someone to have made a clumsy effort to remove their/their mates details from the dump, while forgetting that an admin with the original can run a quick compare to spot the difference.
Plus, who's dumb enough to put any meaningful or traceable data into this sort of forum in the first place?
Thinking two steps ahead can be a challenge for many.
(According to the administrator, the problem stemmed from sloppy handling during the forum's recovery. "During the restoration process, the users table and the forum PGP key were temporarily stored in an unsecured folder for a very short period of time. Our investigation shows that the folder was downloaded only once during that window," N/A added.)
I mean your dealing with people who frequent such sites who have little to no morals, so whether it was download 100000 times or 1 time, thats still 1 time too many if its private data you don't want exposed. So im glad they got a small taste of their own medicine.
Blonde?
Who is the cute blonde woman in the front page teaser?
"Following the publication of this data, undoubtedly many threat actors will face difficulties in hiding their identities and an increased risk of getting arrested,"
Good!