BreachForums in 2026: status, ownership, and recent events

Where BreachForums stands in 2026

BreachForums, the successor to RaidForums, has been the most active English-language forum for trading stolen databases and breach data since its original launch. Through 2025 and into 2026 it remained a primary marketplace for threat actors claiming fresh intrusions, leaked credential dumps, and unreleased data from corporate victims. Its reach across incident disclosure timelines made it a de facto barometer for underground data-leak activity.

The forum's 2026 state is defined by two simultaneous shocks. On March 16, 2026, the forum's administration published a farewell message announcing a leadership transition and openly seeking a new owner. On the same day, the Cyber Counter-Intelligence Threat Investigation Consortium (CCITIC) announced that it had identified the backend infrastructure serving the clearnet domain and coordinated a takedown through the hosting provider. The combination of a leadership vacuum and an infrastructure disruption leaves the forum in its most uncertain state since its founding.

As of this page's last update, the clearnet domain breachforums[.]as returns a 502 Bad Gateway error. The existing moderation team — Loki, Tanaka, 888, and Pine — has stated it intends to stay in place through the transition. The outgoing administration referenced "personal matters and a new venture" as reasons for stepping back and provided contact channels via Session and TOX for parties interested in taking over ownership.

For threat analysts, the practical questions are: who (if anyone) will take over, how long the clearnet mirror stays down, whether existing claims previously hosted on the forum remain reachable, and whether traffic migrates to alternative platforms such as Dread, RAMP, or private Telegram channels. This page tracks each of those signals as new intel lands.

Why this matters for defenders

BreachForums has historically been the earliest public surface for thousands of breach disclosures — often weeks before victim notifications, regulatory filings, or press coverage. When the forum is disrupted, the gap between breach occurrence and public discovery widens. Defenders who relied on forum monitoring for early warning need to adjust: expect slower victim identification, increased reliance on Tor-only mirrors and private channels, and a brief period where threat-actor attribution becomes harder because handles and reputations tied to the forum are diluted.

The other practical implication is that existing BreachForums claims stay relevant even while the forum is offline. A ransomware group that posted a victim to BreachForums last month is still exploiting that victim regardless of whether the post is currently reachable. For incident responders triaging a suspected breach, check all archived claims — not just live ones — when researching whether an organisation has been named.

Timeline of observed events

1. Mar 16, 2026

   BreachForums Goes Dark: Leadership Exit and CCITIC Takedown

   BreachForums clearnet domain returns 502 after CCITIC takedown and the administrator stepped back on March 16, 2026. Forum is seeking new ownership via Session/TOX.

What we are watching next

• Whether breachforums[.]as or a successor clearnet mirror comes back online.
• Whether the moderation team (Loki, Tanaka, 888, Pine) issues any further statements.
• Whether a new administrator is named publicly, and whether the handle is a known entity in the scene.
• Migration of active threat actors to Dread, RAMP, Exploit.in, or private Telegram/TOX channels.
• New claims attributed to BreachForums regulars appearing on alternative venues.