Russia arrests suspected owner of LeakBase cybercrime forum

Recorded: March 26, 2026, 3:26 p.m.

Original

News

Featured
Latest

Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens

HackerOne discloses employee data breach after Navia hack

Firefox now has a free built-in VPN with 50GB monthly data limit

Infinite Campus warns of breach after ShinyHunters claims data theft

TikTok for Business accounts targeted in new phishing campaign

WhatsApp rolls out more AI features, iOS multi-account support

Inside a Modern Fraud Attack: From Bot Signups to Account Takeovers

Coruna iOS exploit framework linked to Triangulation attacks

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityRussia arrests suspected owner of LeakBase cybercrime forum

Russia arrests suspected owner of LeakBase cybercrime forum

By Sergiu Gatlan

March 26, 2026
08:50 AM
0

Russian police in the Rostov region arrested a Taganrog resident believed to be the owner and administrator of LeakBase, a major online forum used by cybercriminals to buy and sell stolen data and hacking tools.
According to a report from the Russian state-owned news agency TASS, Russian Ministry of Internal Affairs spokesperson Irina Volk, who announced the arrest, said the unnamed suspect is also accused of creating the LeakBase hacker platform.
LeakBase surfaced in 2021 as a project supported by the ARES threat group, gradually growing its user base to over 142,000 members after the Breached hacker forum shut down in March 2023.
The forum was free to join and was used by members to sell stolen databases, data leaks, exploits, and other cybercrime services, and also hosted spaces for programming, hacking tips, social engineering, cryptography, and opsec guides.
In March 2026, the FBI and law enforcement agents in 14 other countries took down the LeakBase cybercrime forum in an international joint operation coordinated by Europol, known as "Operation Leak."
Investigators also executed search warrants, conducted interviews, and made arrests in the United States and across Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom.
The LeakBase website (leakbase[.]la) now displays a notice warning that "This website has been seized by the Federal Bureau of Investigation (FBI) as part of an international law enforcement operation." The seizure banner also notes that the forum's database and its contents, including private messages and IP logs, will be used as evidence in future investigations.

Leakbase seizure banner (BleepingComputer)
"On 3 March, law enforcement authorities carried out coordinated enforcement actions across multiple jurisdictions, including arrests, house searches, and 'knock-and-talk' interventions. Around 100 enforcement actions were conducted worldwide, including measures against 37 of the most active users of the platforms," Europol said at the time.
"On 4 March, authorities moved to the technical disruption phase, seizing the forum's domain and replacing it with a law enforcement splash page. The operation now enters a prevention phase aimed at deterring further criminal activity and raising awareness of the consequences of engaging in cybercrime."
LeakBase was shut down after law enforcement took down RaidForums in 2022 and BreachForums in 2023, two other major cybercrime marketplaces that preceded it.

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
Manager of botnet used in ransomware attacks gets 2 years in prisonYanluowang ransomware access broker gets 81 months in prisonInterpol operation Synergia takes down 1,300 servers used for cybercrimeInterpol disrupts cybercrime activity on 22,000 IP addresses, arrests 41Phobos ransomware admin pleads guilty to wire fraud conspiracy

Arrest
Cybercrime
Forum
LeakBase
Russia

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article
Next Article

Popular Stories

Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens

New KB5085516 emergency update fixes Microsoft account sign-in

Microsoft Exchange Online service change causes email access issues

Sponsor Posts

AI is a data-breach time bomb: Read the new report

Overdue a password health-check? Audit your Active Directory for free

Cyber resilience without the complexity. Join Zero Networks to stop lateral movement fast.

Synthetic Identities, Proxies & Real Identities for Sale, is yours next?

Are your AI accounts being sold on the dark web? Check for free.

Upcoming Webinar

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Username

Password

Remember Me

Not a member yet? Register Now

Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

The Russian Ministry of Internal Affairs, alongside international law enforcement, arrested a Taganrog resident identified as the owner and administrator of LeakBase, a prominent online cybercrime forum. This arrest, part of the “Operation Leak” initiative coordinated by Europol, occurred in March 2026 and involved simultaneous actions across 14 countries, including the United States, Australia, Belgium, Poland, Portugal, Romania, Spain, and the United Kingdom. The operation targeted individuals associated with the forum, encompassing arrests, house searches, and “knock-and-talk” interventions. Approximately 100 enforcement actions were executed globally.

LeakBase, which emerged in 2021 following the shutdown of the Breached hacker forum, served as a hub for cybercriminals to buy and sell stolen data, hacking tools, and provide services such as programming assistance, hacking tips, social engineering guidance, cryptography expertise, and opsec resources. The forum boasted a user base of over 142,000 members.

Following the shutdown of RaidForums and BreachForums in 2022 and 2023, respectively, law enforcement took decisive action against LeakBase. On March 3rd, authorities conducted coordinated enforcement activities, resulting in the seizure of the forum’s domain and the replacement of the website with a law enforcement notification banner. This banner, visible at leakbase[.]la, informs users that the FBI has seized the website as part of an international operation and indicates that the database and its contents, including private messages and IP logs, will be used as evidence. The operation has transitioned into a preventative phase, aiming to deter future cybercrime activities and raise awareness of the consequences associated with engaging in illegal online activities. Approximately 37 of the most active users were targeted during the coordinated enforcement actions.