West, a British national, was initially misattributed to Russian actors
After the arrest of the threat actor IntelBroker in February 2025 by the French authorities, specifically the Cybercrime Brigade (BL2C) of the Paris police headquarters, the U.S. announced that it is seeking his extradition. Kai West is primarily known online by the monikers “IntelBroker” and “Kyle Northern.
As part of the same ongoing investigation related to Breach Forums, four other French hackers in their twenties were arrested on Monday, June 23, 2025. These individuals operated under pseudonyms, “ShinyHunters,” “Hollow,” “Noct,” and “Depressed.”
Previously believed to be a Russian national or operating from Russian-speaking territory, Kai West, 25, from Britain, was arrested as part of a joint law enforcement operation.
West was caught in a covert operation wherein an FBI undercover officer purchased stolen data from him for Bitcoin. This allowed investigators to trace the cryptocurrency transaction back to his accounts, including those on Ramp and Coinbase.
The investigator found that the accounts were registered with his UK driving license and personal email, which ultimately gave away his identity as IntelBroker.
The Department of Justice formally unsealed the indictment against West and announced the charges on June 25, 2025. The U.S. announced that it is seeking his extradition to face charges for computer intrusion and wire fraud offenses committed against U.S. victims.
West is charged in a four-count criminal indictment for a global hacking scheme that saw him seek over $2 million from stolen data sales, while simultaneously causing more than $25 million in damages to victims, who often incurred losses for remediation and credit monitoring.
He defrauded victims from at least December 2022 through February 2025 and faces a potential maximum sentence range of up to 20 years in prison.
These are some of his cybercriminal activities and other details about IntelBroker as reported by the U.S. Department of Justice:
The FBI’s arrest of Conor Brian Fitzpatrick, aka “Pompompurin,” in March 2023 halted the dark web marketplace “Breached.”
After this, new French members who included some of the recently arrested individuals, reportedly took over the platform. These individuals are accused of harming numerous victims of high-profile data leaks, specifically in France, including Boulanger, SFR, France Travail, and the French Football Federation.
Following West’s arrest and fearing exposure, other administrators of Breach Forums reportedly suspended the platform’s activities in April 2025. BreachForums was widely used for brokering stolen company data after decrypting data and demanding ransom, shaming the victims for lax data security mechanisms.
These arrests were part of a joint international effort led by the FBI and the Office of International Affairs of the Department of Justice’s Criminal Division in close cooperation with French, Spanish, and British authorities.
