BreachForums Hacking Forum Database Leak Exposes 324,000 Accounts

The notorious BreachForums cybercrime marketplace has suffered a significant breach, exposing sensitive data from 324,000 user accounts. Security researchers confirm the leaked database includes user registration details and IP addresses, creating operational security risks for forum members and potential leads for law enforcement investigations.

BreachForums emerged as a successor to the seized RaidForums marketplace and serves as a hub for trading stolen data, network access credentials, and hacking tools. The platform has faced repeated law enforcement actions and data breaches, with some security analysts speculating it operates as a honeypot for intelligence gathering.

According to forensic analysis by BleepingComputer, the leaked data includes:

• 323,988 user records from MyBB forum software tables
• Display names and registration dates
• IP addresses (70,296 verified as public-facing)
• Forum administrative metadata

The breach originated from an unsecured backup folder during BreachForums' August 2025 migration, as administrator "N/A" acknowledged: "The users table and forum PGP key were temporarily stored in an unsecured folder for a very short period. Our investigation shows the folder was downloaded only once during that window."

Notably, the leak included the forum's PGP private key used for administrator communications. While initially passphrase-protected, cybersecurity firm Resecurity later confirmed the passphrase was publicly released. Security researcher VX-Underground verified the key's authenticity, noting: "Compromised signing keys undermine trust in forum communications, creating opportunities for impersonation attacks."

Operational Security Implications

1. IP Exposure: 70,296 records contain public IP addresses potentially identifying users' locations and ISPs
2. Law Enforcement Value: Exposed data creates investigative trails for tracking cybercriminal activity
3. Reputation Risks: Forum handles could reveal connections to historical breaches or criminal aliases

Brett Callow, threat analyst at Emsisoft, advises: "Participants in illicit forums should assume all interactions are monitored. This breach reinforces why operational security requires disposable credentials, VPNs, and compartmentalized identities. Any user appearing in this dataset should consider their digital footprint compromised."

The incident follows BreachForums' turbulent history, including the October 2025 seizure of its breachforums[.]hn domain by authorities. As underground markets continue evolving, this breach demonstrates the inherent vulnerabilities in criminal ecosystems where trust is commoditized and operational security remains perpetually challenged.

For affected users, security professionals recommend:

• Immediately rotating any credentials associated with forum accounts
• Reviewing digital footprints tied to exposed usernames or emails
• Assuming all forum activity during the affected period is potentially compromised
• Monitoring for law enforcement inquiries related to forum participation

Related resources:

• MyBB Forum Software Security Documentation
• Operational Security Best Practices (CISA Guidelines)
• Digital Footprint Assessment Tools