leaksear.ch has indexed a leaked XenForo database tied to XSS.is, exposing 7,744 forum account records, including usernames, email addresses, password hashes and some account-linked IP data, with the breach date listed as March 18, 2020 (leaksear.ch metadata). The indexed set is smaller than the forum's later public membership figure: AP and Ukraine's SBU reported that XSS.is had more than 50,000 registered users before a 2025 law-enforcement action (apnews.com, ssu.gov.ua).
What happened
The leak-source metadata identifies the source as a leaked XenForo database from XSS.is, a Russian-language cybercrime forum, and says leaksear.ch indexed the dataset on October 11, 2026 (leaksear.ch metadata). Public reporting separately places XSS.is in the upper tier of Russian-language cybercrime forums, with AP citing the Paris prosecutor's office that the site enabled sales of malware, access to compromised systems, stolen data and ransomware-related services (apnews.com).
On July 22, 2025, Europol said a French-led investigation led to the arrest of a 38-year-old XSS administrator, according to KrebsOnSecurity; SBU said its operation with Ukraine's National Police, French law enforcement and Europol partially disrupted the forum's infrastructure (krebsonsecurity.com, ssu.gov.ua). That 2025 action is public context for XSS.is, but it does not explain the 2020 leak in this article.
Confirmed: leaksear.ch indexed a leaked user database with a March 18, 2020 breach date (leaksear.ch metadata). Unconfirmed: the original access vector, the actor that obtained the database and any specific exposure method.
What data was exposed
The indexed records contain four searchable pivots: email address, username, hashed password and IP address (leaksear.ch metadata).
Stored account context includes user IDs, group and permission flags, admin/moderator/staff indicators, ban state, registration and last-activity fields, message and like counts, timezone, language/style settings, avatar metadata, unread alert/conversation counters, terms/privacy acceptance fields and a secret-key field (leaksear.ch metadata). These are account records, not message bodies or full private conversations in the leaksear.ch metadata.
Why this matters
Email addresses and usernames can tie forum identities to accounts on other services, which creates phishing and doxxing risk for people who reused the same handle or address across communities (leaksear.ch metadata). Password hashes are not plaintext passwords, but weak or reused passwords tied to the exposed email field can still create account-takeover risk and force password resets (leaksear.ch metadata). IP addresses and timezone or last-activity metadata can support threat-intel correlation, but Ransomnews cautioned in its analysis of XSS forum telemetry that routing through VPNs, hosting providers and Tor can distort location reads (ransomnews.com). Security teams and individuals should check this leak for the searchable pivots, email, username, hashed password and IP address, then rotate any reused passwords and review account attribution risk (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, hashed password, ip address, and username.
Sources
- AP News: Ukrainian security services arrest suspected administrator of Russian-language cybercrime platform
- KrebsOnSecurity: Who Got Arrested in the Raid on the XSS Crime Forum?
- Ransomnews: XSS forum: from DaMaGeLaB to the 2025 takedown
- Security Service of Ukraine: СБУ спільно з Нацполіцією та правоохоронцями Франції викрила розробника однієї з найвідоміших у світі хакерських платформ