French authorities arrest BreachForums operators tied to massive global data breaches

French police have arrested five individuals accused of operating the infamous BreachForums cybercrime platform, a hub used to trade and leak stolen data impacting millions worldwide. The arrests, carried out on Monday by the cybercrime unit (BL2C) of the Paris police, mark a significant crackdown on a major nexus of online criminal activity.

Law enforcement reportedly conducted coordinated raids across multiple regions, including Hauts-de-Seine in Paris, Seine-Maritime in Normandy, and Réunion, a French overseas territory. Among those detained were four threat actors known online by the aliases “ShinyHunters,” “Hollow,” “Noct,” and “Depressed.” A fifth individual, the notorious “IntelBroker,” was arrested earlier in February 2025, following months of speculation regarding his apprehension.

The suspects are believed to have played key roles in the relaunch and operation of BreachForums v2, the second iteration of the hacking forum that emerged after the original site was shut down in 2023. That shutdown followed the arrest of its first operator, Conor Brian FitzPatrick, also known as “Pompompurin.” The newer version of the site was managed by ShinyHunters and IntelBroker, with Hollow acting as a moderator, while the exact roles of Noct and Depressed remain unclear.

Authorities allege the group had direct involvement in several high-profile data breaches targeting major French organizations, including retailer Boulanger, telecom provider SFR, government agency France Travail, and the French Football Federation. The breach of France Travail was particularly devastating, exposing sensitive data belonging to an estimated 43 million individuals.

IntelBroker gained global notoriety after a series of high-impact cyberattacks, including breaches at Europol, General Electric, AMD, HPE, Nokia, and Cisco. He drew widespread attention in the United States for leaking data from DC Health Link, the agency that manages healthcare coverage for members of Congress and their staff.

ShinyHunters, regarded as one of the most prolific cybercriminal identities in recent years, has been linked to data breaches at Salesforce, PowerSchool, and a series of devastating Snowflake-related attacks. Those attacks impacted major corporations such as Santander, Ticketmaster, AT&T, Neiman Marcus, and Cylance. Cybersecurity analysts believe the ShinyHunters label is used by multiple actors operating collectively.

BreachForums v2 ultimately went offline in April 2025, reportedly due to a zero-day vulnerability in MyBB, the software platform powering the site. The forum has not resurfaced since.

French authorities have yet to officially confirm the arrests. BleepingComputer has reached out to both the Paris police and the French cybersecurity agency ANSSI for comment, but no response has been received at the time of publication.