RaidForums to BreachForums: The Leak Line
RaidForums fell in 2022. BreachForums kept returning. A timeline of the data-leak forum lineage, what seizures change, and why a successor appears within weeks.
Data-leak forums are a format, not a place. A board sells access to stolen databases, runs a reputation system, dies in a raid or a hack, and reappears under a new domain before the press conference is over. RaidForums and BreachForums are the names most people know. The interesting question is not "where is the forum now" — that answer expires — but what a takedown actually captures and why the labor pool does not.
This is a research timeline. It is not a member guide, and it does not link to current hosts.
RaidForums, 2015–2022
RaidForums started in 2015 as a clearnet board for "raids," doxxing and dumped databases. It grew into one of the main English-language marketplaces for leaked SQL files and combolists — the feedstock described in how stolen data moves. The administrator used the handle Omicrone / "Ping."
On 12 April 2022 the FBI and European partners seized the site and announced the arrest of the man they identified as the founder, later named in court papers as Diogo Santos Coelho, in the UK. Members who logged in that day hit a seizure banner. The public success was the domain and the story. The quieter success was the server image: accounts, private messages, and whoever had been sloppy enough to reuse a mail address.
BreachForums and the 2023 arrest
BreachForums opened as the obvious successor: same product, many of the same users, a new coat of paint, partly on Tor. The founder posted as "pompompurin." In March 2023 the FBI arrested Conor Brian Fitzpatrick, a New York man they say ran the board, after a period in which he had already been publicly identified by journalists and rival operators.
The first BreachForums did not stay dead. Other people stood up successors using the name. Through 2023–2025 the brand went through hacks, seizures, infighting and at least one more law-enforcement action against people who claimed the keys. Exact week-by-week ownership is messy; public reporting from Krebs, Recorded Future and Bleeping Computer is the trail to follow, and it disagrees with itself on some of the minor relapses. The pattern does not: a named admin falls, an unnamed admin appears, the file section comes back.
What these boards actually sold
Not "hacking" as a craft. They sold other people's files: corporate customer tables, government dumps, stealer collections, sometimes access. Payment was reputation plus crypto. The buyers were credential stuffers, journalists, rival criminals, and researchers. The carding shops next door sold a different SKU (live cards); the leak forum sold bulk identity.
That mix is why takedowns are popular press and incomplete policy. Seizing a board removes a search box. It does not remove the copies already downloaded, and it does not remove the ransomware leak blogs that publish the next dump for free.
What law enforcement gets from a seizure
- The member database. Handles, emails, IP logs if the software recorded them, private messages. People who "only lurked" are in that table.
- A publicity event. A banner, a press release, a deterrent story.
- A few arrests. Admins and high-volume sellers, when identification works. Most buyers are never named.
- Sometimes a honeypot window. Less documented here than in the Hansa / Bayonet market case, but the incentive is the same: keep the lights on and watch who shows up.
What they do not get: a durable reduction in the supply of breached data. The ransomware leak sites and the stealer shops do not need RaidForums to exist.
Why a successor is up within weeks
The software is generic forum code. The inventory is files people already have. The demand is constant. The brand is a forwarding address for SEO and Telegram rumors. None of that is stored in a single server room in a way that a banner can erase.
Dark web forums as a class survive for the same reason: they are coordination layers. Dread coordinates markets; leak forums coordinate dumps. Kill one hostname and the thread moves. The ecosystem pillar is about discovery tools; this page is about the leak-board lineage that those tools keep finding.
If you were a member, the practical lesson is the same as after any seized market: assume the inbox is an exhibit. Change reused passwords. Do not go looking for "the new URL" on a Hidden Wiki clone.
Frequently Asked Questions
What happened to RaidForums?
It was seized in April 2022. The man prosecutors named as the founder was arrested in the UK. The domain showed a law-enforcement banner. Copies of dumps that had been posted there remained in circulation.
Is BreachForums the same site?
It is the successor culture, not the same server. The first BreachForums admin was arrested in March 2023. Later boards reused the name. Treat "BreachForums" after 2023 as a label, not a single organization.
Why do these forums keep coming back?
Low technical barrier, portable inventory, and buyers who do not care what the hostname is. Arresting an admin removes a manager, not the market.
Can lurking get you arrested?
Most members are never charged. The member database can still name you in a later investigation, and downloading certain classes of data is its own crime. This page is not legal advice; it is a reason not to treat "I only read" as invisible.