Justice Department Announces Seizure of Stolen-Password Database Used in Bank Account Takeover Fraud

The Justice Department has seized a web domain and database used to run bank account takeover fraud, the domain being web3adspanels[.]org, which hosted a backend server storing stolen login credentials. The operation followed a month after the FBI issued a Public Service Announcement on account takeover fraud via impersonation of financial institutions. According to the U.S.

Attorney’s Office, Northern District of Georgia, the scheme delivered fraudulent ads through search engines that redirected victims to fake bank sites where credentials were harvested and then used to drain funds.

To date, the FBI IC3 has received more than 5,100 complaints since January 2025, with reported losses exceeding $262 million, including at least 19 victims in the United States and two companies in the Northern District of Georgia, resulting in attempted losses of about $28 million and actual losses of about $14.6 million.

The seizure disrupts criminals’ ability to access stolen credentials, and Estonian law enforcement is reported as having preserved and collected data from servers hosting the phishing pages and credentials.