LeakBase admin arrested in Russia weeks after global takedown of major stolen-data forum
4 min. read 
Published on
Russian law enforcement has arrested the suspected administrator of LeakBase, a cybercrime forum that investigators say sold stolen personal data, credentials, and hacking-related access for years. The reported arrest took place in Taganrog, in Russia’s Rostov region, and follows the March 4 international seizure of LeakBase infrastructure led by U.S. and European authorities.
The case matters because LeakBase was not a small underground board. The U.S. Department of Justice and Europol described it as one of the world’s largest hacker forums, with more than 142,000 members by late 2025 and a database containing hundreds of millions of stolen credentials and financial records. Russian state-linked reporting cited by multiple outlets said the forum had more than 147,000 registered users and had operated since 2021.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
According to reports that cite Russian Interior Ministry sources and spokesperson Irina Volk, authorities searched the suspect’s home and seized technical equipment and other evidence. Investigators have opened a criminal case under Article 272.1 of the Russian Criminal Code, and the suspect remains in custody.
Why this arrest stands out
The arrest comes only weeks after Operation Leak, a coordinated law enforcement action that seized LeakBase’s infrastructure and data across 14 countries. The DOJ said authorities shut down the forum, seized two domains, collected user data, and posted seizure banners on the site. Europol said the operation also targeted users and sellers tied to the platform.
That sequence makes the Russian arrest more notable. LeakBase had become a major marketplace for hacked databases, stealer logs, usernames, passwords, bank details, and cybercrime tools. According to the DOJ, the forum also hosted messages and records that could now help investigators trace sellers, buyers, and repeat offenders tied to the marketplace.
There is one important nuance. Europol coordinated the March 4 international takedown, but it said it was not involved in the later arrest reported in Russia. TechCrunch quoted Europol spokesperson Claire Georges saying the agency does not cooperate with Russian authorities and had no role in the reported detention.
What authorities say LeakBase enabled
LeakBase allegedly served as a hub for trading:
- stolen usernames and passwords
- payment card and banking information
- hacked databases
- cybercrime tools
- compromised access that could support follow-on attacks
The forum’s scale gave it wider impact than a normal breach forum. Stolen credentials from a platform like this can support account takeover, credential stuffing, identity theft, fraud, and initial access activity against corporate networks. The DOJ and Europol both described LeakBase as a major cybercrime enabler rather than just a message board.
LeakBase case at a glance
| Item | Details |
|---|---|
| Forum name | LeakBase |
| Alleged role of suspect | Administrator / operator |
| Arrest location | Taganrog, Rostov region, Russia |
| Forum status | Seized in international operation on March 4, 2026 |
| Reported member count | More than 142,000 by late 2025; Russian reports cited more than 147,000 |
| Main illicit content | Stolen credentials, hacked databases, financial data, cybercrime tools |
| International action | Coordinated across 14 countries |
| Russian arrest involvement | Reported by Russian authorities; Europol said it was not involved |
Sources: DOJ, Europol, and subsequent reporting citing Russian authorities.
What investigators may look for next
The equipment seized in the raid could help investigators map how LeakBase operated behind the scenes. Devices, storage media, private messages, logs, and wallet traces may reveal how the forum handled access, moderation, payments, and seller identities. That type of evidence often matters as much as the arrest itself because it can expose broader criminal networks.
The bigger question is whether the case leads to more arrests or simply closes one chapter of the marketplace. LeakBase already lost its infrastructure in the March 4 crackdown, so the reported detention may now help authorities connect the seized forum data to specific individuals.
FAQ
Russian authorities reportedly arrested a man from Taganrog whom they accuse of creating and administering LeakBase. Public reports did not name the suspect.
LeakBase was an online cybercrime forum where users allegedly bought and sold stolen data, account credentials, financial records, and hacking-related tools. The DOJ called it one of the world’s largest hacker forums.
No. The takedown happened on March 3 and 4, 2026 and involved 14 countries under a Europol-coordinated operation. The later arrest in Russia was reported separately, and Europol said it was not involved in that detention.
The DOJ and Europol said LeakBase had more than 142,000 members by late 2025. Russian reporting cited a figure above 147,000 registered users.
Forums like LeakBase help cybercriminals scale fraud, intrusions, and credential abuse by making stolen data easy to buy, search, and reuse. Taking down the platform and identifying administrators can disrupt that ecosystem.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages