French cybercrime police arrest five suspected BreachForums admins – Source: go.theregister.com

The Paris police force’s cybercrime brigade (BL2C) has arrested a further four men as part of a long-running investigation into the criminals behind BreachForums.

The arrests on Monday follow the earlier capture in February of a person police suspect of being a cyber crook known as IntelBroker, taking the total number of suspected BreachForums admins in handcuffs to five.

BreachForums is one of the world’s most infamous and popular cybercrime discussion boards. Started in 2022, it ran up until April and acted as a hotbed of adverts for stolen data and recruitment drives for criminal gangs.

First reported by Le Parisien, BL2C only released the aliases believed to be linked to the four individuals arrested this week: Hollow, Noct, Depressed, and ShinyHunters.

Of the four aliases, the latter is the most recognizable, having been associated with the high-profile attacks on Snowflake, Ticketmaster, and AT&T.

It’s also intriguing because the alias was named as though it represented an individual. However, according to cybersecurity analysts, ShinyHunters is a group of criminals, and its members, such as French national Sebastien Raoult, have been imprisoned in the US previously.

The Register asked the Paris police for more information, including the accused individuals’ names, but it did not respond.

The four men are reportedly all in their twenties and are accused of playing a role in the groups’s attacks on the likes of retailer Boulanger, government department France Travail, and the French football federation.

The arrests took place across French territories, from Hauts-de-Seine in Paris’ west, to Seine-Maritime on the north coast of the country, as well as on the island of Réunion – a far away French department in the Indian Ocean that sits between Madagascar and Mauritius. 

As well as IntelBroker and Raoult, international cops have previously nabbed Conor Brian Fitzpatrick, a US national known to his criminal peers as Pompompurin.

Fitzpatrick was a former admin of BreachForums. He was arrested and charged in March 2023, and sentenced to 20 years of supervised release in January 2024. He is still yet to see out his two years of house arrest, which was part of the sentence, but will have regained access to the internet by now – a resource he was banned from using for the first year of his sentence.

The former BreachForums admin pleaded guilty to prosecutors’ allegations that he ran the site, which under his helm facilitated sales of data and cybercrime tools. He was also accused of possessing child sexual abuse material.

The FBI shut down BreachForums in May 2024, which itself took over from Raidforums, which was shuttered in 2022 after a seven-year run.

According to the FBI’s Internet Crime Complaint Center (IC3), ShinyHunters ran the site from June 2023 up until its demise, taking over from Fitzpatrick after his arrest.

• Customer info allegedly stolen from compromised supplier of Royal Mail, Samsung
• There are 10,000 reasons to doubt Oracle Cloud’s security breach denial
• Feds: Army soldier suspected of AT&T heist Googled ‘can hacking be treason,’ ‘defecting to Russia’
• Gilmore Girls fans nabbed as Eurocops dismantle two major cybercrime forums

Following the FBI’s takedown, BreachForums returned just a few weeks later, under a different domain.

That site ran until April this year, but experienced a significant outage, which users suspect was caused by a law enforcement operation, although that has not been confirmed. 

Copycat sites sprung up on a number of occasions since then, and the announcements were signed using BreachForums’ trusted PGP key, yet users remain sceptical over its trustworthiness. ®