leaksear.ch indexed 7,708 account records attributed to the RAMP/RAMP4U cybercrime forum on October 10, 2026, including usernames, email addresses, bcrypt password hashes, and account metadata (leaksear.ch metadata). Public reporting ties RAMP/RAMP4U to an FBI seizure on January 28, 2026, but the metadata does not specify when this account dataset was taken from the forum (www.bleepingcomputer.com, www.zerofox.com).
What happened
RAMP was a Russian-speaking cybercrime forum launched in July 2021 after other forums banned ransomware promotion; BleepingComputer reported that ransomware groups used it to promote operations, recruit affiliates, and buy and sell network access (www.bleepingcomputer.com).
On January 28, 2026, BleepingComputer reported that RAMP's Tor site and clearnet domain displayed an FBI seizure notice, with the notice naming the U.S. Attorney's Office for the Southern District of Florida and the Justice Department's Computer Crime and Intellectual Property Section. DarkOwl separately reported that both the clear net and onion domains showed the notice, that the FBI had not issued a formal statement at the time, and that the domains pointed to FBI seizure name servers (www.bleepingcomputer.com, www.darkowl.com).
ZeroFox reported on January 29, 2026, that screenshots from a suspected leaked RAMP database had appeared in a Telegram channel, including partially blurred email addresses and private-message content, but said the source of that Telegram leak remained unconfirmed (www.zerofox.com). The indexed leaksear.ch source is an account dataset attributed to RAMP Forum (leaksear.ch metadata). The cited public reports describe the seizure and suspected database screenshots, but do not establish how the leaksear.ch indexed account dataset was obtained.
What data was exposed
According to leaksear.ch indexing metadata, the dataset contains:
- Email addresses, searchable in leaksear.ch (leaksear.ch metadata).
- Usernames, searchable in leaksear.ch (leaksear.ch metadata).
- Hashed passwords, searchable as hashedPassword in leaksear.ch and described as bcrypt hashes (leaksear.ch metadata).
- Account metadata, including registration and last-activity timestamps, timezone, user ID, password scheme, and account state, stored on records but not directly searchable (leaksear.ch metadata).
The password material is described as bcrypt hashes, not plaintext passwords (leaksear.ch metadata).
Why this matters
Email addresses tied to usernames can link forum aliases to real inboxes, a higher-signal exposure because public reporting describes RAMP as a venue for ransomware promotion, affiliate recruiting, and network-access trading (www.bleepingcomputer.com). Exposed bcrypt hashes are not plaintext passwords, but OWASP notes that password hashes can still be cracked when attackers test candidate passwords, so weak or reused passwords behind the same email address remain at risk (cheatsheetseries.owasp.org). Registration time, last-activity time, timezone, user ID, and user state can help correlate a forum account with other accounts or reporting when the same username or email appears elsewhere (leaksear.ch metadata). Because BleepingComputer reported that law enforcement may have access to forum user data including emails, IP addresses, and private messages, defenders should treat a match in this leak as an identity and credential exposure indicator, not just a forum-membership artifact (www.bleepingcomputer.com).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, hashed password, and username.