BreachForums
BreachForums is an English-language cybercrime forum where hacked corporate databases are frequently advertised or sold. It has been used by threat actors to publicize intrusions and extortion claims, including claims related to the European Space Agency and France’s Ministry of the Interior. In the latter case, an administrator of the relaunched forum publicly claimed responsibility for the attack, said it was retaliation for the 2025 arrests of five forum moderators and administrators, and threatened to release allegedly stolen French police data. Reported aliases tied to those arrests include ShinyHunters, Hollow, Noct, Depressed, and IntelBroker. The forum has also been linked in reporting to broader cybercriminal ecosystems involving actors associated with ShinyHunters and communities overlapping with Doxbin, SIM-swapping, harassment, and extortion networks. Conor Brian Fitzpatrick, known as “Pompompurin,” was arrested in March 2023 as the alleged administrator of BreachForums.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Observables
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
BreachForums is a well-known hacking forum where threat actors often claim responsibility for breaches and leak stolen data. In this case, a threat actor on BreachForums claimed to have breached European Space Agency servers.
BreachForums is known for facilitating and conducting cyberattacks, data breaches, and extortion campaigns. In this incident, they claimed responsibility for breaching France's Ministry of the Interior, allegedly stealing data on over 16 million people and threatening to release it unless the government negotiates.
BreachForums is an underground forum used by cybercriminals, including groups like ShinyHunters, to trade and sell stolen data.
Cybercrime forum used to sell hacked corporate databases and expose victims to extortion and post-breach monetization.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.