The ripple effect of operation cookie monster: the impact of an illicit market takedown on an untargeted hacker forum

Abstract

Objectives Assess potential spillover effects Operation Cookie Monster (OCM), a law-enforcement takedown of an online market selling stolen account credentials, had on users and administrators of an untargeted hacker forum, a different platform type where similar goods are shared. Methods Treating OCM as a natural experiment, we used data from two sources: observations of forum advertisements and an extension of a prior field experiment. We analyzed changes in posting frequency by user rank, credential types, and administrator content removal before OCM to six months after. Results Activity declined among experienced non-paying users and most credential types, while increasing among paying users and posts advertising social media and cloud accounts. Administrator moderation intensified after OCM, becoming more selective and retroactive, before gradually declining. Conclusions OCM produced temporary diffusion of benefits alongside evidence of crime displacement. Enforcement actions can affect untargeted related platforms, but offender adaptation limits longer-term impact.