324,400 accounts exposed in the BreachForums data leak (2025)

On 10 January 2026, BreachForums — the notorious English-language cybercrime forum used to trade stolen data — saw its own member database leaked online, an embarrassing turn for a site built on others' breaches. The corpus was published by a site bearing the ShinyHunters name and added to Have I Been Pwned the same day, surfacing roughly 324,000 unique user records.

The exposure was self-inflicted rather than a hostile intrusion. During the forum's restoration following an earlier law-enforcement takedown, a backup of the MyBB users table and the forum's PGP key was briefly left in an unsecured, publicly reachable folder. According to the administrator, the folder was online only for a short window and was downloaded once — long enough for the full database to be lifted. The most recent registration in the dump is dated 11 August 2025, the day the prior breachforums.hn domain went dark.

The leaked data covered the forum's user base, with the users table holding about 324,000 unique entries. Exposed fields included:

• Email addresses and usernames (display names)
• Passwords stored as Argon2 hashes
• Registration dates
• IP addresses (around 70,000 records held public IPs of operational-security concern; many others were loopback/local)
• Forum posts and private messages

Have I Been Pwned counted 672,200 affected accounts across the broader corpus once posts and messages were included, while the core users table itself contained roughly 324,000 accounts. The breach predated the October 2025 seizure of the forum's domain by law enforcement; the leaked archive is now irreversibly public, and a successor instance has continued operating under new administration.