BreachForums Seized — Again!

BreachForums was seized, with the splash page now bearing the message “This Domain Has Been Seized” and four shields displayed: Department of Justice, FBI, BL2C, and JUNALCO. According to the exact name, this action followed days of heightened activity as the site’s operators faced pressure over an imminent leak of data from 39 Salesforce customers unless an undisclosed ransom was paid, with a deadline of 10 October at 11:59 PM Eastern.

The clear net version of the forum and leak site appears to be affected, while the onion version remains operational and could still be used to dump the Salesforce victims’ data, including names such as Qantas, Air France & KLM, Disney/Hulu, UPS, FedEx, Home Depot, Gucci, and Toyota Motors. Over the past week, the domain registration and name servers were monitored and subsequently shifted to FBI seized domains, with backup domains similarly redirected to seized servers.

The Telegram channel linked to the operation has been temporarily locked, and DataBreaches has requested comment from Shiny, who had been active about 24 hours earlier. This post notes that the onion version of the leak site with Salesforce victims was not seized.