You have 0 free articles left this month.
Register for a free account to access unlimited free content.
Powered by MOMENTUM MEDIA
lawyers weekly logo

Powered by MOMENTUMMEDIA

For breaking news and daily updates, subscribe to our newsletter.
Advertisement

Downfall: BreachForums admins arrested as IntelBroker’s identity revealed

French police make arrests throughout France as US authorities charge British national Kai West, aka IntelBroker.

Downfall: BreachForums admins arrested as IntelBroker’s identity revealed
expand image

Law enforcement agencies from the United States and France may have put the final nails into the coffin of the infamous hacking community BreachForums following a wave of arrests and the unsealing of a criminal indictment revealing the identity of one of the forum’s most active hackers.

According to Le Parisien, French cyber police arrested four French nationals allegedly responsible for running the forum. The alleged hackers operated under the names “ShinyHunters”, “Hollow”, “Noct”, and “Depressed”, and the arrests were made in Hauts-de-Seine, Seine-Maritime and Réunion earlier this week.

French authorities allege the hackers were responsible for attacks on high-profile French targets such as Boulanger, SFR, and France Travail. ShinyHunters, or individuals operating under that name, was also responsible for a raft of high-profile international attacks, including AT&T, Ticketmaster, and Pizza Hut.

It has also emerged that French authorities arrested another notorious BreachForum member in February 2025. According to an announcement by the United States Attorney for the Southern District of New York and the FBI, Kai West, a 25-year-old British national, is the individual behind the IntelBroker handle and is currently in French custody.

Authorities allege that West has been responsible for a string of cyber attacks against Hewlett-Packard Enterprises, Cisco, and Nokia. In total, West is alleged to have been responsible for more than 40 discrete cyber attacks while operating with a hacking group known as CyberN[------].

“The IntelBroker alias has caused millions in damages to victims around the world,” said US attorney Jay Clayton in a 25 June statement.

“This action reflects the FBI’s commitment to pursuing cyber criminals around the world. New Yorkers are all too often the victims of intentional cyber schemes, and our office is committed to bringing these remote actors to justice.”

West is charged with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, accessing a protected computer to obtain information, and wire fraud. If found guilty on all counts, West could face up to 50 years in prison. The US is seeking West’s extradition from France.

“Kai West, an alleged serial hacker, is charged for a nefarious, years-long scheme to steal victim’s data and sell it for millions in illicit funds, causing more than US$25 million in damages worldwide,” FBI assistant director-in-charge Christopher G. Raia said.

“Today’s announcement should serve as a warning to anyone thinking they can hide behind a keyboard and commit cyber crime with impunity; the FBI will find and hold you accountable no matter where you are.”

Speaking to Cyber Daily, Aaron Bugal, Field CISO, APJ, at Sophos, said that the arrests are a good thing to see.

"These coordinated operations take a great deal of effort to plan and execute, and I'm sure the next one is already underway," Bugal said.

"While it seems like a never-ending cat and mouse game taking these sites out, cyber-criminals are on notice that no site or activity will go without investigation, and it's merely a matter of time before law enforcement catches up with them. These major law enforcement operations will force cyber-criminals to constantly look over their shoulders until they're caught.”

BreachForums has been effectively down since it was revealed the forum suffered a data breach of its own in April, when it was apparently infiltrated by an unnamed law enforcement agency. Since then, versions of the site have popped up, with some users and former admins worried that the new sites were honeypots.

“We would like to provide an update on recent events over the past two weeks. In or around April 15, we received confirmation of information that we had been suspecting since day [one] – a MyBB [zero]-day,” a BreachForums spokesman said in April.

“This confirmation came through trusted contacts that we are in touch with, which revealed that our forum is subject to infiltration by various agencies and other global law enforcement bodies.”

Looks like that spokesperson was correct.


UPDATED 26/06/25 to add Sophos commentary.

David Hollingworth

David Hollingworth

David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.

You need to be a member to post comments. Become a member for free today!

newsletter
cyber daily subscribe
Be the first to hear the latest developments in the cyber industry.