The FBI seizes BreachForums domains used by ShinyHunters as a data leak extortion site for its Salesforce campaign, which the hacker group says is unaffected
The FBI has seized last night all domains for the BreachForums hacking forum operated by the ShinyHunters group mostly as a portal …
Context & Ripple Effects
BreachForums has repeatedly been a law-enforcement target: the FBI previously seized the forum in 2024, following a 2023 clear-web domain seizure and alleged administrator arrest. The recurrence makes the latest action notable as another interruption to a venue used to publish and market stolen corporate data.
This seizure is tied specifically to ShinyHunters' Salesforce-focused extortion activity. The group’s assertion that its campaign is unaffected distinguishes disruption of its public-facing leak infrastructure from disruption of the underlying campaign.
First-order effects
- BreachForums’ seized domains are immediately unavailable as a publication and extortion channel for ShinyHunters, disrupting access for visitors, victims, and prospective data buyers.
- Salesforce-related targets lose one visible venue through which ShinyHunters could pressure them, while the group says the campaign itself continues.
Second-order effects
- ShinyHunters will need to rely on alternate channels to sustain public pressure or distribute material, reducing the value of any single forum domain as an extortion asset.
- The action reinforces the operational risk for cybercriminal groups that depend on public leak portals, while giving affected organizations a narrower set of visible channels to monitor.
Third-order effects
- Repeated takedowns suggest that domain seizures can suppress a forum’s reach without necessarily dismantling the operators or the data-extortion model behind it.
- If this pattern persists, cybercrime enforcement will remain a contest between disrupting public infrastructure and groups’ ability to shift campaigns across replacement channels.
The trend: Data-extortion groups are becoming less dependent on any one public forum, while law enforcement continues to target the infrastructure that makes their campaigns visible and monetizable.