Journal article
Objectives: Assess potential spillover effects Operation Cookie Monster (OCM), a law-enforcement takedown of an online market selling stolen account credentials, had on users and administrators of an untargeted hacker forum, a different platform type where similar goods are shared.
Methods: Treating OCM as a natural experiment, we used data from two sources: observations of forum advertisements and an extension of a prior field experiment. We analyzed changes in posting frequency by user rank, credential types, and administrator content removal before OCM to six months after.
Results: Activity declined among experienced non-paying users and most credential types, while increasing among paying users and posts advertising social media and cloud accounts. Administrator moderation intensified after OCM, becoming more selective and retroactive, before gradually declining.
Conclusions: OCM produced temporary diffusion of benefits alongside evidence of crime displacement. Enforcement actions can affect untargeted related platforms, but offender adaptation limits longer-term impact.
Text and figures are licensed under Creative Commons Attribution CC BY 4.0. The figures that have been reused from other sources don't fall under this license and can be recognized by a note in their caption: "Figure from ...".