Canadian man charged with running and collecting $200K from LeakedSource, a site that sold access to a database of ~3B compromised account passwords
Alastair Sharp / Reuters :
Context & Ripple Effects
LeakedSource operated as a search engine over breached credentials rather than a dump site: it published data from the major 2016 breaches of LinkedIn, MySpace, and VK.com, claimed it could crack 99% of the passwords from the FriendFinder Networks breach affecting 412M accounts, and was criticized for actively cracking what it sold. The alleged police raid that took the site offline in January 2017 left the question of who ran it unanswered until now.
This charge answers it: a Canadian man allegedly collected $200K running the service, putting a price tag on brokering access to a database of roughly 3 billion compromised passwords. It also fits a pattern of Canadian-based actors in large-scale credential crime facing cross-border prosecution, seen again years later when Canadian authorities arrested Alexander "Connor" Moucka over the Snowflake hacks.
First-order effects
- The alleged operator now faces criminal charges and the loss of $200K in proceeds, while the hundreds of millions of people whose LinkedIn, MySpace, VK.com, and FriendFinder credentials were made searchable learn their data was not just leaked but commercially resold.
- Law enforcement has moved past takedown to attribution — converting the 2017 raid into a named suspect with a documented revenue stream.
Second-order effects
- Credential-sale marketplaces are pushed toward more opaque distribution, since a public search-and-sell interface proved easy for police to locate, raid, and trace to its operator.
- Breaches become double-cost events for victim companies: the initial compromise plus downstream liability exposure when their password databases surface on commercial services, sharpening scrutiny of the weak hashing that let LeakedSource crack 99% of FriendFinder's credentials.
Third-order effects
- Enforcement is shifting up the stack — from the hackers who steal data to the intermediaries who monetize it — a trajectory continued by the Moucka case ending in a US guilty plea after the 2024 arrest of the alleged Snowflake hacker by Canadian authorities, suggesting durable Canada–US cooperation against data-theft operations run from Canadian soil.
- If prosecutors keep treating aggregated-credential businesses as criminal enterprises rather than mere recipients of leaks, the resale layer of the breach economy gets priced like organized crime, with operators weighing long prison exposure against modest recorded revenues like this $200K.
The trend: Cybercrime enforcement is climbing from individual hackers to the commercial middlemen who package and sell stolen credentials, with cross-border cases increasingly reaching Canadian-based operators.