US indicts one for role in BreachForums, France arrests four others – Source: www.csoonline.com

A US court indicted a man accused of being IntelBroker, a key administrator of stolen data marketplace BreachForums, on Wednesday, just days after four others accused of running the site alongside him were arrested in France.

British national Kai West, 25, was arrested in France in February, and US authorities are seeking to extradite him to the US to face the charges on which he was indicted in the US District Court for the Southern District of New York. These include conspiracy to commit computer intrusions, wire fraud offenses and unauthorized access to protected computers.

Earlier in the week, the French Cybercrime Brigade arrested four people believed to be ShinyHunters, Hollow, Noct, and Depressed, also involved in BreachForums, according to French media reports.

Together, the five are believed to have taken over the site following the June 2023 arrest of its founder Conor Brian Fitzpatrick, aka Pompompurin. The warrant issued for West’s arrest in February claimed that he and his co-conspirators had cumulatively caused the victims of computer intrusions and thefts of data losses of at least $25 million.

The arrests mark a major blow to the latest iteration of BreachForums, a marketplace long linked to high-profile data breaches and identity theft campaigns.

Stephen Kowski, Field CTO at email security provider SlashNext, said, “These arrests represent a significant win for international law enforcement and demonstrate that cybercriminals can’t hide behind forum anonymity forever.”

Prosecutors allege West stole and sold data from entities spanning government agencies, telecoms providers, tech giants including AMD, HPE, and Nokia, and healthcare providers.

Assumed active on BreachForums since shortly after pompompurin’s arrest, IntelBroker claimed responsibility for a series of high profile hacks between January 2023 and December 2024, including Europol, DC Health Link, Cisco and General Electric, operating primarily through the forum for trading stolen health records, internal corporate documents, and user data.

If convicted in the US, he could face up to 25 years in prison on several of the charges filed against him.

Four alleged co-conspirators nabbed in France

Following an investigation by the Cybercrime Brigade of the Paris Police Prefecture, French police arrested four people believed to be BreachForums operators ShinyHunters, Hollow, Noct, and Depressed in coordinated raids in the Paris region, Normandy and on the French island of Reunion earlier this week, according to a report by French newspaper Le Parisien. All four are reportedly French and in their twenties, the newspaper reported.

The four are believed to have helped manage and moderate the revived BreachForums after its 2023 takedown. While ShinyHunters and Hollow held admin and moderator roles, respectively, the involvement of Noct and Depressed remains less defined.

The Paris Police Prefecture did not respond to a request for comment.

BreachForums, a successor to the shuttered RaidForums, has long operated as a go-to-marketplace for stolen data–facilitating leaks tied to breaches of major French entities like Boulanger, SFR, France Travail, and the French Football Federation. Despite multiple takedowns and arrests of key admins, the forum repeatedly resurfaced under new leadership continuing to fuel cybercrime across borders.

And that may not be the end of it, warned Agnidipta Sarkar, chief evangelist at ColorTokens, developer of a Zero Trust microsegmentation platform.

“It remains unknown whether there are remnants of their organization that could revive themselves to be smarter and more egregious, mainly because the forum’s reemergence after previous takedowns in 2023 and 2024 demonstrates its resilience,” Sarkar said.

Whether it’s BreachForums that returns, or another such site, said SlashNext’s Kowski, “Organizations need to assume their data will eventually surface on these platforms and focus on real-time protection that can detect and block attacks even when using legitimate but compromised credentials or information.”