In a significant strike against one of the world’s most active data leak marketplaces, French law enforcement has arrested five members of the infamous BreachForums, dealing a major blow to the criminal underground economy.
The suspects, all French nationals, were detained during coordinated raids conducted by the Cybercrime Brigade of the Paris Police headquarters in Hauts-de-Seine, Seine-Maritime, and Réunion. Among those arrested is the notorious “IntelBroker,” a key administrator linked to several high-profile breaches and previously apprehended in February.
From Russia to France: the unexpected origins of BreachForums
French outlet Le Parisien first reported the operation, which contradicts longstanding assumptions that BreachForums was operated by Russian nationals. The forum, long considered a successor to the dismantled RaidForums, hosted some of the most damaging leaks in recent years, including stolen data from DC Health Link, which exposed sensitive information belonging to U.S. lawmakers and their families, as well as breaches involving AMD, Cisco, and General Electric.
“This arrest is a step in the right direction,” said Nivedita Murthy, Senior Staff Consultant at Black Duck. “While there has been growing focus on holding organizations accountable for protecting data, there’s been a relative lack of attention on bringing data thieves to justice. The recent arrests highlight the need for laws and initiatives that severely penalize malicious data brokers, thereby deterring them from engaging in such activities in the future.”
Meet the operators: ShinyHunters, IntelBroker, and the BreachForums brain trust
The remaining four suspects, allegedly operating under aliases like “ShinyHunters,” “Hollow,” “Noct,” and “Depressed,” are believed to have played central roles in the forum’s leadership and moderation. These actors have been linked to data breaches targeting French companies, including France Télécom, Boulanger, SFR, Accor, and LVMH.
Authorities have not yet disclosed the full scope of charges or details about the seized infrastructure. Still, early statements suggest the suspects were involved in trafficking vast troves of stolen data, selling access credentials, and facilitating illicit services to a global buyer base.
As Trey Ford, CISO at Bugcrowd, emphasized, the challenge in disrupting these ecosystems lies in their global sprawl. “The actors managing these forums may be in one country, but hosting and infrastructure could be in several others,” Ford said. “Ultimately, we work against human adversaries who operate in coordinated campaigns, and taking them down requires global collaboration—both legal and operational.”
[RELATED: ShinyHunters Hits Ticketmaster with Breach Impacting 560 Million Users]
The cost of a breach: financial fallout and public distrust
The arrest of IntelBroker in particular has drawn attention due to his role in sharing confidential law enforcement documents and medical data tied to significant breaches. A recent indictment from the U.S. Department of Justice accuses him of causing more than $25 million in damages and violating laws related to computer intrusion and wire fraud.
However, experts caution that while these arrests are a victory for law enforcement, they may not signal the end of BreachForums. The forum has proven resilient, reemerging after takedowns in both 2023 and 2024.
“Law enforcement must go beyond arrests and focus on sharing high-level details of how these forums operate—general attack tactics, common vulnerabilities, and behavioral patterns—without compromising active investigations,” said Agnidipta Sarkar, Chief Evangelist at ColorTokens. “These repeated breaches not only inflict financial damage but erode public trust in digital platforms, especially when data theft hits institutions like France’s largest telecom and luxury brands.”
Sarkar also warned that the financial implications are staggering. “Remediation, legal fallout, and reputational damage could stretch into the billions,” he said. “Meanwhile, individuals affected by these breaches face long-term psychological harm: increased anxiety over identity theft and a growing mistrust of the digital systems they rely on every day.”
A global threat, a global response
The arrests also underscore a shift in the geography of cybercrime. As J. Stephen Kowski, Field CTO at SlashNext, noted: “The fact that these operators were French nationals rather than Russian shows how global and decentralized these criminal networks have become. They’re no longer limited to traditional cybercrime hotspots.”
Kowski also highlighted the transformation of forums like BreachForums into fully developed criminal marketplaces. “What’s particularly concerning is how these platforms weaponize stolen data into highly targeted social engineering and credential-based attacks. Organizations need to assume their data will surface on these forums and invest in real-time protections that detect malicious behavior even when credentials appear legitimate.”
The road ahead: disruption or a brief pause?
As of now, all five suspects remain in custody—one is in extradition proceedings to the U.S., while the others are being held in France under investigation. Whether this operation fully dismantles BreachForums or merely pauses its activity remains to be seen.
But the message is clear: anonymity is no longer a guarantee, and cybercriminals are increasingly within reach of international justice.
Follow SecureWorld News for more stories related to cybersecurity.