Doomsday for Cybercriminals: BreachForums Gets Breached

The Hunters Become the Hunted

January 9, 2026. A date that will live in cybercriminal infamy.

Someone calling themselves "James" - possibly a former ShinyHunters member - dumped the entire BreachForums database. 323,986 user records. Credentials. Emails. IPs. Registration data. Everything.

The next day, they published the password to the forum's PGP private key.

The largest dark web forum for data leaks just got data leaked.

---

What Got Exposed

Field	Value
Total Users	323,986
Database	MySQL (MyBB forum software)
Table	hcclmafd2jnkwmfufmybb_users
Contents	Credentials, emails, IPs, registration metadata
PGP Key	Private key password published

The Admin Accounts

Handle	Role	Email	IP
ShinyHunters	Admin	[email protected]	185.93.3.195
888	Moderator	[email protected]	-
Tanaka	Super Moderator	[email protected]	-
Hollow	Super Moderator	[email protected]	-
Loki	Moderator	[email protected]	-

The ShinyHunters admin used a Pokemon-themed email. Of course they did.

---

The ShinyHunters Admin IP

185.93.3.195

Network:   CDN77-MADRID-1
Provider:  CDN77.com
Location:  Madrid, Spain
Owner:     DataCamp Limited (London, UK)
AbuseIPDB: Score 1 (clean)

They're routing through legitimate CDN infrastructure. Smart OPSEC - CDN77 is a real content delivery network used by legitimate businesses. Hides in plain sight.

But now we know the entry point.

---

The "888" Connection

This is where it gets interesting.

Moderator 888 - email [email protected] - is the same threat actor who:

Date	Action
December 2025	Breached ESA (European Space Agency)
December 2025	Leaked 200GB from Bitbucket repositories
January 2026	Posted ESA spacecraft data on BreachForums

We covered 888's ESA breach in Scattered Spider Goes to Space. Now their email is burned.

The actor who leaked spacecraft operational procedures just got doxed on their own forum.

---

Infrastructure

The Leak Site

Field	Value
Domain	shinyhunte[.]rs
Registered	October 2, 2025
Registrar	Webglobe d.o.o.
Admin Contact	Key-Systems GmbH (St. Ingbert, Germany)
DNS	Cloudflare
Previous Hosting	DDoS-Guard

Timeline of Compromise

Date	Event
March 21, 2023	BreachForums shut down after Conor Brian Fitzpatrick arrest
Post-2023	Forum reopens under ShinyHunters / "Baphomet"
May 15, 2024	Domain seized, recovered via EPP code within hours
April 2025	ShinyHunters claimed MyBB zero-day, migrated infrastructure
October 2, 2025	shinyhunte[.]rs domain registered
January 9, 2026	"James" leaks full database
January 10, 2026	PGP private key password published

---

The PGP Problem

The forum's PGP private key password is now public.

• Forge official admin communications

• Verify historical signed messages (prove authenticity)

• Impersonate ShinyHunters leadership

• Decrypt any messages encrypted to that key

Every "official" forum announcement is now suspect. Trust in the platform is zero.

---

Geographic Distribution

Threat actors in the database originate from:

Region	Countries
North America	United States
Europe	Germany, Netherlands, France, United Kingdom
Middle East	Turkey
MENA	Morocco, Jordan, Egypt

---

Intel Value

For Law Enforcement

• Ransomware affiliates

• Data brokers

• Extortionists

• Sextortion operators

• Credential stuffers

• The entire dark web data trade ecosystem

Email addresses. IP addresses. Registration timestamps. Behavioral patterns. Cross-reference with existing investigations. Connect pseudonyms to real identities.

For Defenders

• 185.93.3.195 - ShinyHunters admin (CDN77 Madrid)

• shinyhunte[.]rs - Leak site domain

• Email patterns for attribution

For the Cybercriminal Ecosystem

Trust collapse. If BreachForums can't protect its own users, who can? The irony is perfect - a forum built on stolen data gets its data stolen.

---

IOCs

Infrastructure

Type	Value	Context
IPv4	185.93.3.195	ShinyHunters admin IP
Domain	shinyhunte[.]rs	Leak distribution site
Email	[email protected]	ShinyHunters admin
Email	[email protected]	Moderator "888" (ESA breach actor)
Email	[email protected]	Moderator "Tanaka"

Network Context

Field	Value
ASN	CDN77 (AS60068)
Netblock	185.93.0.0/22
Registrant	DataCamp Limited
Abuse Contact	[email protected]

---

The Pattern

BreachForums has been compromised multiple times:

1. 2023: Founder arrested, forum shut down

2. 2024: Domain seized (recovered quickly)

3. 2025: Claimed zero-day, emergency migration

4. 2026: Full database leaked by insider

Each time they rebuilt. Each time they claimed better security. Each time they got owned.

The forum that sold 323,986 people's data just had 323,986 people's data sold.

---

What Happens Next

• Mass password resets (futile - emails are burned)

• Forum migration attempts

• Trust collapse in the ecosystem

• Law enforcement cross-referencing

• Arrests (some of these 323,986 will get knocks on doors)

• Ecosystem fragmentation (smaller, more paranoid forums)

• Increased OPSEC paranoia

• More insider threats (trust no one)

---

The Lesson

There's a certain poetry to it.

A forum built entirely on stolen data. A community that celebrated every breach, every leak, every violation of privacy. A marketplace where 323,986 people traded in human misery.

And then someone did to them what they did to everyone else.

The cybercriminal's dilemma: you can't trust anyone, because everyone is exactly like you.

---

• Resecurity - Doomsday for Cybercriminals

• DugganUSA - Scattered Spider Goes to Space

• CDN77/DataCamp WHOIS records

• AbuseIPDB enrichment

---

Her name is Renee Nicole Good.