BreachForums User Database Leaked, Exposing 320,000+ Accounts On January 9, 2026, a database containing details of over 320,000 users of the cybercrime forum BreachForums was publicly released. The leaked dataset, analyzed by cybersecurity firm Resecurity, includes user display names, email addresses, password hashes (using Argon2i encryption), and links to external accounts. The data was published on shinyhunte.rs, a site previously associated with hosting corporate breach dumps. BreachForums, a successor to the defunct RaidForums, has been a key platform for illicit activities, frequently resurfacing after takedowns. The leaked database totaling 323,986 records was accompanied by a PGP signature tied to former forum operators, lending credibility to its authenticity. Forum administrators attributed the exposure to an unsecured directory during a restoration process in August 2025, insisting it was not the result of an active breach. However, the release of email addresses and password hashes heightens risks of user identification and potential follow-on attacks. A manifesto signed by an individual named "James" was also included, though researchers dismissed it as likely disinformation or an attempt to generate attention. The incident underscores the persistent vulnerabilities in underground forums, even as operators attempt to downplay the severity of the leak.

BreachForums Resurfaces—Then Falls Again After Data Exposure In a fresh twist in the cybercrime underground, a revived version of the notorious hacking forum BreachForums was itself compromised in August 2024, months before law enforcement dismantled the platform in October 2024. The breach exposed 672,000 unique email addresses scraped from user profiles, forum posts, and private messages—highlighting the risks of underground marketplaces even as authorities crack down. Nearly 53% of the leaked emails were already indexed by LinkedIn, suggesting many victims were professionals or individuals with public digital footprints. The incident underscores the persistent threat posed by cybercriminal forums, where stolen data often circulates before law enforcement intervention. While the takedown disrupted operations, the prior breach serves as a reminder of the volatile nature of these platforms and the lingering exposure of compromised credentials.

BreachForums Hacked: 324,000 Accounts Exposed in Irony-Laden Cyberattack In a striking twist, BreachForums a notorious hacking forum used to trade stolen data and cybercrime tools was itself breached, exposing approximately 324,000 user accounts. The incident, reported by Bleeping Computer, involved an SQL file containing usernames, registration details, and IP addresses, which surfaced on a site linked to the ShinyHunters extortion gang. Of the compromised accounts, 70,296 included public IP addresses, potentially enabling law enforcement to identify and track malicious actors. The breach occurred during a domain migration, with BreachForums’ administrator attributing the leak to an "unsecured folder" left vulnerable during the transition. Adding to the irony, ShinyHunters alleged that BreachForums was a "honeypot" a fake platform operated by law enforcement to ensnare cybercriminals. This isn’t the forum’s first breach; it has faced repeated security failures in the past. BreachForums, a hub for hackers selling illicit data and tools, was seized by authorities on August 11, 2025, before resurfacing under a new domain. The latest breach underscores the persistent vulnerabilities in even the most infamous cybercrime platforms.

Global Crackdown on Cryptocurrency Scam Centers Yields 276 Arrests, $700M in Seized Funds A sweeping international operation led by Dubai Police, in collaboration with the FBI and China’s Ministry of Public Security, has dismantled nine cryptocurrency scam centers and arrested 276 suspects linked to fraud schemes targeting Americans. The coordinated effort, part of Operation Level Up, has prevented an estimated $562 million in losses since its launch in January 2024, with authorities notifying nearly 9,000 victims as of April 2026. Among those charged are six individuals including Thet Min Nyi (27), Wiliang Awang (23), and Andreas Chandra (29) accused of running fraudulent companies (Ko Thet Company, Sanduo Group, and Giant Company) that orchestrated "pig butchering" scams. These schemes involved building trust through fake romantic or friendly relationships before luring victims into fraudulent cryptocurrency investments. Once funds were transferred, assets were laundered into accounts controlled by the fraudsters. The operation also exposed ties to human trafficking, with foreign nationals coerced into running scams under slave-like conditions after being deceived by false job offers. In a separate case, two Chinese nationals Jiang Wen Jie and Huang Xingshan were charged for their roles in the Shunda scam compound in Myanmar, where trafficked workers were forced to defraud victims under threats of violence. Huang, a high-level manager, allegedly participated in physically punishing workers, while Jiang oversaw teams targeting Americans. Both were arrested in Thailand in early 2026 while traveling from Cambodia to Burma. The crackdown extended to digital infrastructure, with authorities seizing a Telegram channel (@pogojobhiring2023) used to recruit trafficking victims and 503 fake investment websites. Over $701 million in cryptocurrency tied to money laundering was restrained, while the U.S. Treasury sanctioned Cambodian Senator Kok An and his associates for operating scam centers under the K99 Group. Kok An, linked to cyber fraud and human rights abuses, remains at large after fleeing Thailand. Cambodia has responded by passing its first law targeting scam centers, imposing 5–10-year prison sentences and fines up to $250,000 for convicted operators. Meanwhile, researchers uncovered an Android banking trojan likely originating from the K99 Triumph City compound used since 2023 to steal credentials and drain bank accounts. The malware, distributed via fake government and banking domains, has expanded to target victims in Africa and Latin America, with 400 new lure domains registered in 2025 alone. In parallel, Operation Atlantic froze $12 million from a cybercrime ring using "approval phishing" to hijack cryptocurrency wallets, affecting over 20,000 victims across 30 countries. The U.S. Treasury also launched a cybersecurity initiative to share threat intelligence with digital asset firms, aiming to bolster defenses against evolving fraud tactics.

Rockstar Games Hit by Second Major Hack in Three Years; Stolen GTA 6 Footage Leaked Rockstar Games, the developer behind the Grand Theft Auto franchise, confirmed a cyberattack after hackers leaked 90 video clips of unfinished GTA 6 gameplay online. The breach, attributed to the cybercriminal group ShinyHunters, occurred over the weekend when attackers claimed to have infiltrated Rockstar’s servers via a third-party cloud provider. The group demanded a ransom, threatening to release additional stolen data including source code and internal files if their demands were not met. Rockstar downplayed the incident, stating the breach involved "a limited amount of non-material company information" and would have "no impact" on its operations or players. However, the leak forced the company to accelerate the release of its official GTA 6 trailer, originally planned for later in the year. ShinyHunters, a prolific English-speaking hacking collective believed to consist of teenage cybercriminals, has a history of targeting major corporations through cloud storage breaches. The group previously claimed responsibility for high-profile attacks, including those on other gaming and tech firms. This marks the second time Rockstar has been hacked in three years, following a 2022 breach by the Lapsus$ gang, which also involved the theft of GTA 6 development materials. Law enforcement agencies, including the FBI, advise against paying ransoms, citing concerns that such payments fund further criminal activity without guaranteeing the deletion of stolen data. The incident underscores ongoing vulnerabilities in third-party cloud security, particularly for high-profile targets in the gaming industry.