Law enforcement agencies in the United States and France have seized two CSAM domains linked to NudeLeaksTeens (NLT), a website that advertised hacked and stolen sexually explicit images and videos of young women and girls for sale. French authorities simultaneously arrested a 25-year-old man in Northern France suspected of being the site’s main administrator.
The action was announced by the U.S. Attorney’s Office for the Eastern District of Virginia (EDVA), the FBI Washington Field Office, and the Cybercrime Division of France’s Parquet de Paris.
It was carried out under Operation Inevitable, a coordinated effort against the spread of child sexual abuse material (CSAM) and the non-consensual publication of intimate images. The seizure notice now displayed on the sites also references Operation Torch.
What the Seized CSAM Domains Offered
According to the seizure warrant, NLT sold leaked content that had been hacked and stolen from victims. Investigators found that despite warnings on the website against CSAM, the site also offered sexually explicit images and videos of children.
The site sold content in packages it called “albums” and “collections.” Many included victims’ personal identifying information alongside explicit material. Some victims have been identified and confirmed to have been minors when the images were created.
One package named after the site claimed to contain 6,200 private files of teenagers and adults, mostly American, taken from hacked Snapchat, Instagram, TikTok, and Facebook accounts. Authorities say this collection also contained CSAM.
How the CSAM Domains Were Taken Down
The United States obtained court authorization to seize both domains. Visitors now see a notice stating that the FBI took control of the sites under a seizure warrant issued by the U.S. District Court for the Eastern District of Virginia, citing several federal statutes.
The notice carries the insignia of the FBI, the Department of Justice, the Arlington County Police Department, the Parquet de Paris, and the French Gendarmerie’s national cyber unit, UNCyber.
In France, police arrested a 25-year-old man living in the northern part of the country who is suspected to have been NLT’s main administrator. The arrest was carried out at the same time as the seizure of the CSAM domains.
FBI Comments on CSAM Domains Seizure
Darren B. Cox, Assistant Director in Charge of the FBI Washington Field Office, said, “The seizure of these domains represents a decisive step in dismantling the criminal networks that hide behind anonymous online platforms to exploit victims.”
Cox said the operation cut off the infrastructure used to distribute images and videos obtained by hacking victims’ social media accounts, striking at the core of the illicit marketplace. He added that the FBI will continue to act against those who use the internet to cause harm, wherever they operate and whoever they target.
The announcement was made by Theophani K. Stamos, First Assistant U.S. Attorney for EDVA; Cox; and Charles “Andy” Penn, Arlington County Chief of Police. The Justice Department’s Office of International Affairs provided significant assistance.
Assistant U.S. Attorneys April Russo, Lauren Halper, and Meredith Clement are representing the United States.
A Joint Effort Against Online Exploitation
Officials credited cooperation among national, international, and private sector partners for the operation. The case shows how hacked social media accounts can become a source of material sold on illicit sites, affecting both adults and minors.
