How a Telegram Leak of 918 Databases Fueled a Dark‑Web Power Struggle

Background

After a series of law‑enforcement actions by the FBI and French police at the end of 2025, the hacker collective ShinyHunters attempted to retake control of BreachForums in early April 2026. The group announced that the forum’s infrastructure had been completely rewritten and migrated to a distributed‑hosting architecture to avoid the single‑server takedowns that had previously crippled the site.

Internal Conflict

In January 2026, an anonymous hacker identifying as James published a 4,400‑word “Destruction Day Manifesto.” The manifesto accused ShinyHunters of mismanagement, citing a $4,000 funding dispute and disagreements over whether to target French entities. James framed the dispute as evidence of weakened governance within ShinyHunters.

Leak Distribution

The 918 paid databases that were previously sold on BreachForums were released for free through a Telegram channel named "Scattered Lapsus$ Hunters" (also referred to as The Com HQ ). The channel posted compressed archives containing all 918 databases, effectively turning a paid‑access commodity into a publicly available resource.

Datasets Released

Nvidia – historical copy from 2022.

T‑Mobile & Experian – large‑scale breach data from 2015.

LinkedIn – historical archive from 2012.

Auxiliary service data for SoundCloud and Crunchbase collected at the end of 2025.

Strategic Objective

The free release was presented as a “decentralization” and “free distribution” campaign intended to destroy ShinyHunters’ attempt to rebuild commercial credibility. By making the data freely available, the rival group aimed to eliminate any incentive for users to purchase access on the relaunched forum.

Code example

“我超越世代，我不是黑客，我是捕食者。”
2026年1月，神秘黑客 James 发布 4400 字“毁灭日宣言”，宣告 BreachForums 内战爆发。
他嘲讽 ShinyHunters 是“一群被惯坏的孩子”，并放下狠话：“这些孩子曾属于我，现在，是时候吞噬我的子嗣，终结你们的宿命。”
伴随这份疯狂宣言，918 个付费数据库被公之于众。这不是简单的泄露，这是一场针对暗网秩序的“焦土战争”。