FBI seizes the domain of WeLeakInfo, a site offering usernames and passwords from data breaches for sale; WeLeakInfo claims to have 12B+ usernames and passwords
Site aggregated 12 billion usernames and passwords from over 10,000 breaches. — On Wednesday, police in the Netherlands …
Context & Ripple Effects
WeLeakInfo's seizure is the third takedown in this corpus of a site whose business was reselling breached credentials. LeakedSource went offline after an alleged police raid in 2017 (LeakedSource's takedown), and Leakbase shut down weeks later with sources tying its closure to the Hansa dark web market raid (Leakbase's shutdown).
What distinguishes the WeLeakInfo action is scale and coordination: the site claimed 12 billion usernames and passwords aggregated from over 10,000 breaches, and the FBI acted alongside Dutch police — the same cross-border playbook later applied when the FBI took down BreachForums in 2024 (BreachForums seizure).
First-order effects
- WeLeakInfo's paying customers lose access to a searchable database of 12 billion+ credential pairs, cutting off a ready-made toolkit for credential-stuffing and account-takeover attempts.
- The FBI and Dutch police gain the site's infrastructure and records, a template for identifying both the operators and the buyers of stolen data.
Second-order effects
- Credential resellers face a demonstrated enforcement pattern — LeakedSource, Leakbase, WeLeakInfo — pushing remaining operators toward darker channels like forums and dark web markets rather than open subscription sites.
- Organizations breached in the underlying 10,000+ incidents get a window: credentials exposed on a commercial marketplace are harder for attackers to reach while the aggregator is down, briefly lowering account-takeover pressure on their users.
Third-order effects
- The recurring pattern points toward credential-market takedowns as routine, internationally coordinated law enforcement work rather than exceptional actions — raising the operating risk of any site that monetizes breach data at scale.
- If aggregators keep getting seized, breach data monetization migrates to decentralized or invitation-only channels, which are harder to seize but also harder for ordinary criminals to access.
The trend: Law enforcement is systematically dismantling the commercial market for breached credentials, with each seizure — LeakedSource, Leakbase, WeLeakInfo, BreachForums — normalizing cross-border action against sites that resell stolen data.