A dark web user was found selling account credentials allegedly from the Law Enforcement Enterprise Portal (LEEP).
The Federal Bureau of Investigation relies on LEEP as a platform that offers specialized investigative tools, analytical solutions, and internal networking opportunities.
The alleged FBI LEEP data sale can mean information of a critical nature is at risk of being misused by cybercriminals. The services offered by LEEP are used by US law enforcement agencies, intelligence groups, and criminal justice organizations.
The above screenshot shows the FBI LEEP breach with a watermark on top of the portal page. The watermark of @FEDCREDS could not be taken as proof of the FBI LEEP hacking as did not log in to the portal.
The FBI LEEP credential leak was tweeted by a retired National Security Agency personnel, Cyber Omniscience.
The tweet read, “#FedCreds is selling account credentials (username/password) for the FBI’s Law Enforcement Enterprise Portal (LEEP). #SiegedSec.” If true, the FBI LEEP credential sale by SeigedSec puts classified emails and projects at risk.
It is not clear how many login credentials have been put on sale by the SeigedSec hacker group. Nor is it known if the credentials are genuine.
Two waves of a campaign wherein emails were sent in bulk were found in a previous instance of an FBI LEEP cyber attack.
This incident was investigated by the international nonprofit Spamhaus Project, which specializes in tacking spammy emails, phishing attempts, and malware among others.
This FBI LEEP email scam took place on 13 November 2021 and it involved sending fraudulent emails to over 100,000 recipients. The fraudulent alerts impersonated the FBI and urged users to be watchful of chain attacks.
The FBI LEEP emails were found to be sent from a legitimate ID – eims@ic.fbi.gov. The hacker was using the FBI’s IP address 153.31.119.142.
The email addresses of the over 100,000 recipients of the FBI LEEP fraudulent emails were scrapped from the American Registry for Internet Numbers (ARIN). ARIN is a nonprofit that monitors IP addresses for security purposes among others.
The issues related to the present sale of the FBI LEEP credentials could allow prominent hackers to log in and send malicious emails to several connected legal agencies.
Regardless of the legitimacy of the FBI LEEP data sale of usernames and passwords, now is a critical time to change login credentials by all US legal agencies. It is not clear if hackers have logged in to harvest the credentials of others in their contacts.
Credential hacking puts not just one organization or individual at risk but, all those whose emails a cybercriminal finds.
How the hacker found access to the first FBI LEEP user could be due to brute forcing or guessing login credentials, or using an infostealer or an information stealing malware.
Cybercriminals have also been known to cause MFA fatigue to employees of an organization, in this case, the ride-sharing platform, UBER.
A hacker from the Lapsus group caused MFA fatigue to an employee by sending multiple MFA authentication notifications on their device.
To stop the flow of messages, the Uber staff eventually accepted a login request leading to the Uber cyber attack.
Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.
Microsoft’s August 2026 Patch Tuesday fixes roughly 400 flaws, including three Zero-days, with one actively exploited and two publicly disclosed.
The joint advisory was published August 10, 2026, as part of the ongoing #StopRansomware initiative.
New Zealand has now imposed sanctions on more than 2,000 Russian individuals, entities and vessels, alongside trade restrictions. T
Suisun City Emergency follows a cyberattack that shut down the city’s IT network, disrupting police, fire and 911 communications.
An AI agent exploited a gym system vulnerability in Australia, booked classes months ahead and cancelled another user's reservation.
The Justice Department’s Office of International Affairs provided substantial assistance with Silnikau’s extradition and the collection of evidence.
This website uses cookies. By continuing to use this website you are giving consent to cookies being used.
Read More