An international operation coordinated by Europol has allowed the arrest of an individual and the carrying out of two home searches in Spain, one of them in the province of A Coruña, within the framework of the investigation against the stolen data forum LeakBase.
Dismantled one of the largest personal data trading platforms
The police intervention has been carried out simultaneously in 14 countries and has involved the participation of the National Police and the Civil Guard, along with authorities from different jurisdictions. LeakBase accumulated more than 142,000 registered users and operated since 2021, combining a traditional forum with a clandestine market for personal data on the clearweb.
On the forum, the purchase, sale, and exchange of sensitive information was facilitated, used for fraud, identity theft, account hijacking, and illicit access to computer systems. The repository of compromised databases was constantly updated, including both old and recent leaks. Among the internal rules of the forum was the express prohibition of publishing or selling data related to Russia.
Police action in Spain and profile of the suspects
In Spanish territory, the agents identified two users with advanced technical knowledge, allegedly involved in the forum's activity. Both suspects would have used complex anonymization systems and advanced techniques to hide their digital footprint. After their identification, one of them was arrested and two home searches were carried out in the provinces of A Coruña and Bizkaia.
During the searches, agents seized numerous computer equipment and relevant documentation for the investigation. The second suspect remains pending location and arrest. Authorities are keeping the investigation open to identify more users involved in the buying and selling of stolen data.
International impact and analysis of the intervened information
The operational phase took place between March 3 and 4, with nearly 100 police operations directed against 37 of the forum's most active users. The seizure of the LeakBase database has allowed the identification of numerous users who believed they were operating anonymously.
The authorities continue with the analysis of the seized material and the tracking of the information obtained after the forum's seizure. The objective is to identify more people allegedly involved in the illicit activity. The international dimension of the platform became evident in December 2025, when figures reflecting its global reach were recorded.