French authorities have arrested five alleged administrators of BreachForums, including prominent figures known as “ShinyHunters” and “IntelBroker,” in what appears to be a decisive blow against one of the most notorious English-speaking cybercrime platforms.
According to an exclusive report by Le Parisien, four suspects in their early 20s were apprehended on Monday, June 24, 2025, during coordinated operations led by the Brigade de lutte contre la cybercriminalité (BL2C) across Hauts-de-Seine, Seine-Maritime, and the overseas department of Réunion. A fifth suspect, reportedly operating under the alias “IntelBroker,” had already been arrested earlier in February 2025.
The group is accused of running BreachForums, a successor to the now-defunct RaidForums, and a major hub for trading stolen data, leaked databases, and hacking tools. Since its creation in March 2022, BreachForums served as a key meeting point between threat actors conducting cyberattacks and buyers seeking fresh exfiltrated data. Victims of data breaches linked to the forum include French corporations such as SFR, Boulanger, France Travail, and even the national football federation.
The arrests reportedly include users known online as “ShinyHunters,” “Hollow,” “Noct,” and “Depressed.” These individuals are accused of managing the second-generation BreachForums operation that emerged following the March 2023 arrest of American citizen Conor Brian Fitzpatrick, aka “Pompompurin,” the forum’s original administrator.
This development comes just two months after the platform experienced a prolonged outage starting mid-April 2025. At the time, forum administrators attributed the downtime to an exploit targeting a zero-day vulnerability in MyBB, the software powering the site. They denied any compromise or arrests and claimed to be conducting a backend rewrite to prevent future incidents. However, on April 22, a separate domain purporting to be a BreachForums relaunch displayed a message claiming that “IntelBroker” and “Shiny” had been arrested, an assertion now seemingly validated by French law enforcement action.
Despite multiple prior enforcement actions, including the FBI-led seizure of BreachForums infrastructure in May 2024, the platform had continued operating under various new domains. The latest arrests suggest that law enforcement agencies have been quietly tracking the new leadership structure of the forum since its relaunch, eventually leading to the identification and capture of the individuals behind it.
At this time, there has been no official statement from the FBI, BL2C, or other international law enforcement partners confirming the arrests or revealing the precise legal charges. However, if these reports hold, the disruption could signal the end of BreachForums' second iteration, or at minimum, fracture its remaining user base and leadership structure.
Leave a Reply