RaidForums, used by Lapsus$, Babuk, and other extortion gangs, is seized in a US-led international operation; Europol says the hacking forum had 500K+ users
The RaidForums hacker forum, used mainly for trading and selling stolen databases, has been shut down and its domain seized …
Context & Ripple Effects
The seizure of RaidForums — a marketplace where gangs like Lapsus$ and Babuk traded stolen databases to an audience Europol puts at over half a million users — opened a now-familiar cycle in which law enforcement takes down the dominant data-leak forum only for a successor to rise. That successor dynamic played out quickly: BreachForums filled the vacuum, saw its alleged operator arrested and its clear web domain seized in 2023, and was hit again when the FBI took down the site and its Telegram channel in the 2024 BreachForums seizure.
The pattern has since escalated from domain seizures to infrastructure and arrests: Europol and German police seized 17 servers to kill Cracked and Nulled in the January 2025 crackdown on two forums claiming 10M+ users, and authorities from 14 countries shut down LeakBase with multiple arrests in the March 2026 LeakBase takedown. RaidForums is the opening data point of that arc.
First-order effects
- Extortion crews like Lapsus$ and Babuk lose their main venue for monetizing stolen databases, forcing hundreds of thousands of buyers and sellers of breached data onto smaller or newer forums overnight.
- The US-led operation removes a single chokepoint where leaked corporate data was aggregated, priced, and resold — degrading buyers' ability to shop across breaches in one place.
Second-order effects
- Successor platforms absorb the displaced traffic — BreachForums emerged as RaidForums' heir and became the next seizure target, confirming that each takedown relocates rather than eliminates the market.
- Law enforcement shifts tactics in response: later operations against Cracked, Nulled, and LeakBase pair domain seizures with server confiscations and arrests, raising the operational cost of running these forums.
Third-order effects
- If the seizure-arrest-rebuild cycle holds, data-leak marketplaces fragment into shorter-lived, more decentralized venues — pushing stolen-data trading toward channels harder to seize wholesale, while giving prosecutors a repeated template for cross-border operations.
- Each successive takedown normalizes multi-country coordination against cybercrime infrastructure, making joint operations the default response rather than the exception for forums of this scale.
The trend: Data-leak forums are locked in a recurring seize-and-succeed cycle in which each takedown spawns a replacement, while law enforcement responses grow from domain seizures to coordinated arrests and server confiscations.