No More Shadows: BreachForums Admins & Users Exposed by (Shinyhunters — James)

On January 9, 2026, the legacy domain associated with the infamous hacking extortion gang ShinyHunters has made a dramatic makeover that featured a grand manifesto signed by a sender whose handle is “James” along with a leaked database of metadata for more than 323,997 Lines.

Size of: 612 MB (642,455,905 bytes) Infected by Malware ensure AV’s turned ON if you download it directly to source

Before we jump into the chaos of January 9, 2026, it’s worth understanding how we got here.

The story starts with RaidForums, one of the biggest hacking hubs.

The Predecessor: RaidForums (2015–2025)

Before “BreachForums” there was “RaidForums” a hacking and data leak forum that launched 2015 by a teenage known as “Omnipotent” real name (Diogo Santos Coelho).

Diogo Santos Coelho . Photograph: Linda Nylind/The Guardian

Raidforums became famous as it becomes famous as it is primary tradecraft is trading massive stolen databases, credentials, exploits, and other illicit goods. Around April 2022 an international law enforcement operation led by the FBI seized the domain raidforums and arrested Omnipotent in the United Kingdom, it also took down the key admins like “Jaw” and “Moot”.

Birth of BreachForums (March 2022)

Weeks later in March 2022, a known raidforums user named “Pompompurin” real name (Conor Brian Fitzpatrick, 19, New York)

A yearbook photo of Fitzpatrick unearthed by the Yonkers Times.

launched the new hacking and data leak forum called “BreachForums” (often called breached or breach). It attrack the same crowd: Hackers, Databrokers, Extortionist, Whistleblowers, Journalist, Researchers, Law Enforcement Agents and from low to mid level cybercriminals. The forum offered leak databases, hacking tools, access sales, and more with over 340,000 members at its peak and hosting billions of stolen records.

First Major Disruption: Pompompurin’s Arrest (March 2023)

March 15, 2023 when FBI arrested “Fitzpatrick” at his home in Peekskill, New York. He admitted to being “Pompompurin” and running the site. The Forum went offline after on (March 17–21, 2023), with remaining admin “Baphomet” shutting it down over fears of compromised.

Read More: https://www.justice.gov/opa/pr/founder-one-worlds-largest-hacker-forums-resentenced-three-years-prison

Revival Under ShinyHunters & Baphomet (June 2023 onward)

After a brief hiatus, “Baphomet” partnered with the infamous “Shinyhunters” extortion group (known for high-profile breaches) to relaunch breachforums in June 2023 under new domain (often called V2) which faced skepticism and many users feared it was a honeypot.

Repeated Seizures & Comebacks (2024–2025)

• June 23,2023: First Domain Seizure, 3 months after the initial shutdown and quick revival of under leadership of “Baphomet and Shinyhunters” the FBI, U.S Department of Health and Human Services (Office of the Inespector General), and Department of Justice seized the clearnet domains. The forum had been active again after short period of time.

• May 2024: Second Domain Seizure, FBI Operation seized domains, onion sites and telegram channels. Seizure banners mocked admins (including Baphomet and Shinyhunters in “handcuffs”).

• April 28, 2025: Suspected MyBB Zero-Day Infiltration, forum admins posted a PGP-Signed statement claiming law enforcement exploited an undisclosed zero-day vulnerability in the MyBB forum software for covert access.

• June 2025: Arrest of Key Admins, French police announced the arrest of four admins (Hallow, Noct, Depressed, and Shinyhunters) followed by the arrest of “Intelbroker” real name (Kai West, a 25-year-old British) the admin. However according to some sources this were affiliates as “Shinyhunters” group still continued it operations.

• August 12, 2025: Shutdown Amid Honeypot Claims, forum went offline after “Shinyhunters” alleged a full compromised by French BL2C, DOJ, and FBI.
• October 10, 2025: Third Domain Seizure, this followed attempts after relaunching under a new domain (.hn) but law enforcement disrupted it again.
• December 13, 2025: A new BreachForum under leadership of “[Admin] Indra” made a statement regarding breachforum.

January 9, 2026: A former “Shinyhunters Member” name “James Mathis”, using their official website has exposed the database of the current BreachForums with a chilling manifesto that consist of 23 pages.

Read Full Statment Here: https://tinyurl.com/ShinyhuntersJames |

James clearly stated identities of individual connected to breachforum admins includes some other notable names:

Balzac — “I know you have read Balzac and, as he did, understood that all fortunes are born from of crimes. But you learnt it as an experience, when so many did as a professorial lesson.”

Nahyl Ojeda (used N/A’s account, INDRA) — “Nahyl Ojeda, whom has used N/A’s account, INDRA, you and your barely reached sixteenth birthday, fall and begone ! Cloth your naked villainy with old odd ends stolen of holy writ, and buy a suitable saintly show, as the hot breath of your relentless judges deploy through your neck and send you to unlimited obscurity. Shiver, my friend !”

Ali Aboussi, Donald, Kernel — “Ali Aboussi, my dear Donald, my adorable Kernel, who is said to have been born on 2009, February the 11th, say goodbye to Kahyl and Ali, as well as to your youth. Prepare your ablutions, as soulless fleshes seize you.”

Rémy Benhacer, Youri — “Rémy Benhacer, Youri ! You, my dear launderer, my adorable middleman, whom did not hesitate to denounce your friends, you, your talentless freak, you, your Judas ! whom, nurtured by all, from Kuroish and his vile coins to Kam’s and N/A delusional thoughts, you, whom sought for redemption through delation and betrayal. A dieu !”

Nassim Benhaddou and Gabriel Bildstein, Prosox and Kuroish — “Nassim Benhaddou and Gabriel Bildstein, Prosox and Kuroish, my dear old boys, you whom I have bred and whom have unleashed all this, you whom have corrupted generations of worshipers, you in which I had put my faith, you whom corrupted Yurosh and Trihash, before egoistically sailing to new shores in your pitiful Maseratis, you whom created RaidForums, BreachForums, invented extorsion at massive levels, rode over life as if it was endless, whose lifes have been consumed by vice in spite of all the efforts made to save your souls, yes you too, good night and good luck !”

MANA (MUSTAPHA USMAN), Yukari, Semtex/Warzax (Nadir Smaani), Pupupuh, Omar… Benkachouzi — “MANA (MUSTAPHA USMAN), Yukari, Semtex/Warzax (Nadir Smaani), Pupupuh, Omar… Benkachouzi, yes, you, yes, wretched impersonators, agents of nil, dissolve into your virtual ether. You, whom all served me without knowing so, renounce to your hopes. Time has come.”

Yurosh and Trihash — “you whom corrupted Yurosh and Trihash” (in reference to Prosox and Kuroish).

Edward Snowden — “I was requested to save Edward Snowden”

It appears to me that James (Mathis) manifesto reflects deep sadness, anger, betrayal and grief over the fates of people he views as his “children” whom were key figures in “Shinyhunters and BreachForums operations”.

• Sebastien Raoult (“Sezyo Kaizen”) — A prominent ShinyHunters member, arrested in Morocco in 2022 and was sentenced in September 2025 in Seattle’s U.S. District Court to 3 years in prison + over $5 million in restitution for conspiracy to commit wire fraud and aggravated identity theft.

Sebastien Raoult “I feel free even under judicial supervision” • © Hélène Leplat. France Télévisions

• June 2025 French arrests — French police (BL2C Cybercrime Brigade) arrested four alleged BreachForums/ShinyHunters admins in coordinated raids: ShinyHunters, Hollow/Noct/Depressed (handles for people in their 20s, arrested in Paris suburbs, Normandy, and Réunion).
• February 2025 — arrest of Kai West (“IntelBroker”), a 25-year-old British national indicted in the US for massive data sales/leaks (causing $25M+ damages).

Kai West (“IntelBroker”)

On the last article of James statement after the message “Breachforum, open your doors. Let the evil flow and become light.” You will need to click “Accept” to automatically download the database.

Size of: 612 MB (642,455,905 bytes) Infected by Malware ensure AV’s turned ON if you download it directly to source

Inside the databoose.sql file is a list of all users consist of 323,995 lines consist of (UID, Username, Password, Loginkey, Email, Usergroup, Additional Usergroup, Regdate, Last Active, Last Visit, Last Post, Birthday, Reputation, Last IP, Reg IP, Time Online etc.) On the other hand, the first on this list are the key figures of the BreachForums ecosystem.

Below are the list of admins and some notable users on BreachForums.

From Databoose.sql Note: There are 600+ users from the Philippines that includes all local actors.

On the same day administrator of the breachforums “[Admin] N/A” has respond to the statement of James.

On the following day another statement was made by “[Admin] N/A”.

This proves that when you meet online friends, at first you feel like you can do anything. You receive praise and support, and it gives you confidence. But in the end, once you are apprehended by law enforcement, you become just a story. People talk about you, but you are the one who suffers. In the dark web, betrayal is nothing new.

Many researches have now in depth analyzed the data so I will skip to that part and save it to next content (Detailed analysis will be publish). There are lots of mystery that needs to be uncover and analyze, with that I do not wish to assume that we’re done here because we don’t know what tomorrow is, will update this story once theres something new.

From webarchive “Shiny Hunters” website

Deception Tactics 101: The main reason why deception is common on dark web due to its environment that is design to for maximum anonymity, outside legal protection and attracts people who were planning or already engage in illegal activities.

Image capture before the new update James Story (Deception is nothing new on DarkWeb)

To be continue. . .