With LeakedSource shuttered, rivals selling compromised passwords could see a boost

Days after the disappearance of LeakedSource, a large breach database rumored to have been raided by U.S. authorities, hackers dependent on the site’s collection of billions of passwords for compromised accounts are now searching for a replacement to source their stolen credentials. Competitors are reporting a boost in business while they are concerned about what could happen to their own sites.

“Removing 3.1 billion passwords that were so readily available makes it less convenient for cybercriminals, but only makes a small dent when you realize that there are countless other sources for the same data,” Shuman Ghosemajumder, former Googler and now CTO of security firm Shape Security, said.

In chat rooms and forums across the web, the conversation has turned to where to go next. LeakedSource has a long trail of satisfied customers who speak glowingly about their easy and powerful service. Any potential replacement has big shoes to fill.

Websites like Leakbase, another paid breach notification site, follow much the same model that LeakedSource did. They provide journalists with news in exchange for being credited in articles, a tactic that gains them visibility, credibility and ultimately paying customers. They also establish themselves in the communities that discuss and work with this kind of data, such as HackForums.net.

Leakbase’s owners, who describe themselves as “a small group of developers and pentesters,” say they currently have “several thousand customers it provides services for, as well as many well known businesses that have paid for domain monitoring.” They declined to respond to requests for more specifics on themselves or their customers.

They are seeing more traffic since LeakedSource went down as well as increased conversation on social media pointing toward Leakbase.

The exact fate of LeakedSource remains unknown. The U.S. Justice Department has so far declined to comment on the record about any possible action against the site, so since the site was taken down and the usually very talkative LeakedSource administrators went suddenly incommunicado, all anyone has to go on are rumors and unsourced Pastebin posts. Before the site went down, however, legal experts said LeakedSource was breaking U.S. law.

“We are very much concerned, if the case is that were actually arrested or things were confiscated however no factual evidence has been shown yet,” Leakbase’s owners told Cyberscoop. “However is that is the reason for LeakedSource, then we might have to shut down our service or shift the way we run the site to prevent issues with Law enforcement. We have no intention of breaking the law and putting our team at risk.”

Simple, if we feel like we’re breaking the laws by running the service, we will discuss it with the team and most plan to shut down the service. However till this point we have received ABSOLUTELY no contact from any company or law enforcement complaining about the service we offer.

LeakedSource was used regularly by hackers who see the repository of stolen information as a gold mine. The administrators there never commented publicly on that criticism. Similarly, Leakbase administrators declined to  comment on these charges as well.