The criminal bazaar BreachForums has been revived just two weeks after a coordinated law enforcement action dismantled and took control of its infrastructure.
Cybersecurity researchers and dark web trackers Brett Callow, Dark Web Informer, and FalconFeeds revealed the site’s return at breachforums[.]st, where a user named ShinyHunters is offering a 1.3 TB database of allegedly 560 million Ticketmaster customers for sale at $500,000.
This includes full names, addresses, email addresses, phone numbers, ticket sales, event information, and the last four digits of credit cards with expiration dates.
Visitors are now required to sign up for an account to access the content on the site.
The law enforcement action seized all new domains of BreachForums while suggesting that the site administrators Baphomet and ShinyHunters may have been arrested.
The FBI disclosed that they are reviewing the site’s backend data after seizing the Telegram channel run by Baphomet.
It’s unclear if the ShinyHunters persona on BreachForums is the original hacker or how they obtained the site seized by the FBI.
There are concerns in the cybersecurity community that it may be a honeypot.
BreachForums first appeared in March 2022 after the shutdown of RaidForums and the arrest of its owner. It was taken down in mid-June 2023 and later resurrected by Baphomet and ShinyHunters.
The U.S. Department of Justice and the FBI have not commented on the takedown or the forum’s re-emergence.
