Russia arrests suspected LeakBase admin weeks after FBI-Europol takedown

Russian police have detained a man from Taganrog suspected of creating and running LeakBase, a major English-language forum for trading stolen databases. It came three weeks after the FBI and Europol seized the site in Operation Leak. Arrests inside Russia over forums like this are rare. For engineering teams the takedown is also a reminder: LeakBase's archive held hundreds of millions of leaked credentials, and some of them may belong to your users.

What happened

On 25 March 2026 Russian Interior Ministry spokesperson Irina Volk announced the detention, and state news agency TASS added details from a law-enforcement source. The suspect, a Taganrog resident in the Rostov region, was detained by the ministry's Bureau of Special Technical Measures with local police and is in custody. TASS reports a criminal case under parts 3 and 6 of Article 272.1 of the Russian Criminal Code, a recently added article covering the illegal use and transfer of personal data. The source said the forum had run for about four years, had more than 147,000 registered users, and used credits and a reputation system to keep traders active.

That followed Operation Leak. According to the US Justice Department, on 3 and 4 March 2026 the FBI, coordinated through Europol with authorities in 14 countries, seized LeakBase's database and two domains, replaced the site with a seizure banner, and carried out searches, arrests and interviews in the US, Australia, Belgium, Poland, Portugal, Romania, Spain and the UK. Europol reported about 100 enforcement actions, including measures against 37 of the most active users. The DOJ said LeakBase had more than 142,000 members, over 215,000 messages, and an archive of hacked databases containing "hundreds of millions" of account credentials. The FBI's banner warned that private messages and IP logs from the seized database would be used in future investigations.

Who is affected

• LeakBase users, whose accounts, messages and IP logs are now in law-enforcement hands.
• People and companies whose data was traded there. LeakBase launched in 2021 and grew after Breached shut down in March 2023, so its archive covers years of breaches.

What it means for developers and engineering teams

Takedowns disrupt the market but don't delete what was already copied. Databases traded on LeakBase have been downloaded and mirrored many times and will keep feeding credential-stuffing attacks. Forum takedowns have also followed a pattern: RaidForums in 2022, BreachForums in 2023, LeakBase in 2026. Each time, activity moves to the next venue. Defences against reused credentials matter more than any one forum.

What to do now

• Check passwords against breach corpora at sign-up and password change, for example with the Have I Been Pwned Pwned Passwords k-anonymity API, and reject known-breached passwords.
• Detect credential stuffing: rate-limit logins per IP and per account, watch for high failure rates across many usernames, and add bot challenges when thresholds trip.
• Offer and encourage MFA or passkeys, especially for admin and payment-capable accounts.
• Monitor for your own domains in breach-notification services so you learn about exposed staff or customer data early.

Related on TechLogHub

• Authentication: defending logins against reused credentials

Sources

• TASS: Administrator of LeakBase detained (Russian)
• BleepingComputer: Russia arrests suspected owner and admin of LeakBase cybercrime forum
• Security Affairs: Russian authorities arrest alleged LeakBase admin
• US DOJ release (via GlobalSecurity): United States leads dismantlement of one of the world's largest hacker forums
• Security Affairs: Operation Leak, FBI and Europol dismantle LeakBase