FBI and French Authorities Seize NudeLeaksTeens Sites, Arrest Two Brothers and Identify Over 17,000 Victims

The FBI Washington Field Office, the cybercrime division of the Paris Prosecutor’s Office and the U.S. Attorney’s Office for the Eastern District of Virginia have seized two domain names linked to the NudeLeaksTeens platform and arrested two brothers suspected of running it. The operation, carried out with French law enforcement, identified more than 17,000 women and girls worldwide whose intimate images were being sold.

The seized domains—NudeLeaksTeens and NLTVIDS—were part of a network that French authorities widened when they shut down three more linked websites during the operation, TechNadu reported. The Paris prosecutor’s office announced Oct. 7 the arrest in northern France of a 25-year-old man and his 21-year-old brother on suspicion of administering the platform.

The warrant that enabled the domain takedowns was filed Oct. 2, 2026, in the Eastern District of Virginia.

Investigators described a marketplace where users sold stolen intimate images alongside victims’ personal identifying information. The platform rewarded users with cryptocurrency for supplying those personal details, which were then added to the listings.

Authorities also seized approximately €700,000 in cryptocurrency—Bitcoin, Litecoin, USDT and Ethereum—from the suspects’ residences, Help Net Security reported. The same tokens were used to reward uploaders and to pay for content.

Some of the material sold on the sites was illegal content depicting children, despite the platform’s own posted warnings against such material. The sites also carried imagery that falls under the TAKE IT DOWN Act, a 2025 federal law that criminalizes the creation or sharing of nonconsensual “intimate” deepfake media of real people and gives enforcement authority to the Federal Trade Commission.

Arlington County police detective and FBI cybercrime task force member John Bamford filed the seizure warrant. It directed VeriSign, the Reston, Virginia-based registry for .com domains, to redirect the targeted domains to FBI-designated name servers, according to court documents. David McGuire, a VeriSign spokesperson, told CyberScoop the company executed its responsibilities under the warrant and has no connection to the websites or their administrators.

Law enforcement first became aware of the websites in 2024, when they advertised illegal imagery of minors obtained through hacking and leaks. Some victims reported to law enforcement that attackers had compromised their social media accounts on Snapchat, TikTok, Instagram and Facebook to get the images, confirming that account takeovers were the primary harvesting method.

The sites had links to individuals already convicted of offenses against children, court filings show. A court gave Andrew Venegas a 30-year sentence in April 2026 and sentenced Reuben Oswaldo Yeverino Rosales to more than 34 years in 2022. The filings connected both to the NudeLeaksTeens operation.

The takedown is the latest in a series of cross-border operations that rely on simultaneous warrants and shared intelligence. Strong, unique passwords and multifactor authentication make it harder for attackers to break into social media accounts and harvest private material. No user is at fault for the crime, but making accounts harder to compromise shrinks the pool of images that such platforms can exploit.