Cybercrime forum Leak Zone leaks 22 Million user login records
Take action: Hackers are no better in securing their infrastructure than their victims. But that doesn't mean we shouldn't work to be better.
Learn More
A cybercrime forum that supports illegal activities has an ironic security lapse that exposed the IP addresses and login timestamps of its own users through an unsecured database.
Leak Zone, a self-described "leaking and cracking forum" where users trade stolen data and breached credentials, left critical user information accessible to anyone. Cybersecurity researchers at UpGuard, found an Elasticsearch database connected to Leak Zone that had been left openly accessible to the internet without any password protection or access controls.
Exposed data includes:
- IP addresses of forum users
- Precise login timestamps
- Proxy usage indicators (whether users accessed the site through VPNs or other anonymization tools)
- Real-time user activity patterns
The exposed database contained over 22 million login records. These records represent login sessions rather than unique individuals. According to Leak Zone's own claims, the forum has more than 109,000 registered users. UpGuard researchers verified that 95% of the exposed records related to Leak Zone user logins, and the remaining 5% referenced accounts associated with AccountBot, another cybercrime site focused on selling access to compromised streaming service accounts.
The exposed database captured precise timestamps of when users accessed the illegal forum, along with their IP addresses and indicators of whether they were using anonymization tools like VPNs or proxies. This information could be used by law enforcement agencies to identify cybercriminals who accessed the forum without proper anonymization protections.
TechCrunch journalists verified the accuracy of the exposed data by creating a test account on Leak Zone and logging into the forum. Their IP address and the exact timestamp of their login immediately appeared in the exposed database, confirming that the system was capturing and storing user activity data in real-time.
Researchers attempted to contact Leak Zone administrators to notify them of the security exposure but were unable to send messages due to forum software restrictions that blocked communications with administrators. It's unclear whether the forum operators are aware of the data exposure or whether they have notified their users about the security lapse.
UpGuard confirmed that the exposed database is no longer accessible online, so it seems the security issue has been fixed.
