Former BreachForums Administrator Sentenced to 3 Years in Prison

Conor Brian Fitzpatrick, the founder of the first iteration of the BreachForums cybercrime forum, received a three-year prison sentence during a resentencing hearing held in a Virginia federal court. Prosecutors initially sought a much stiffer sentence of nearly 16 years, arguing this was necessary to deter Fitzpatrick, 22, from reoffending and to signal to other would-be cybercriminals the severity of such actions. Fitzpatrick had proposed a lighter arrangement involving only one year of weekend incarceration, followed by probation and supervised release.

Known online as “Pompompurin,” Fitzpatrick pleaded guilty in July 2023 to multiple charges, including access device fraud and possession of child sexual abuse material. U.S. Attorney Erik S. Siebert emphasized the extensive damage caused by Fitzpatrick’s criminal activities, arguing that the human cost associated with his collection of illegal content is immeasurable. He vowed to pursue justice against individuals operating in the shadows of the internet.

Authorities apprehended Fitzpatrick at his parents’ home in Hudson Valley, New York, on March 15, 2023. They linked him to his online persona, revealing that he had made nearly $700,000 by facilitating the sale of stolen data through BreachForums. The platform became notorious for its role as a marketplace for cybercriminal activities following the closure of the FBI-operated RaidForums.

In January 2024, U.S. District Judge Leonie M. Brinkema initially sentenced Fitzpatrick to merely 17 days in jail, coupled with two decades of supervised release, citing concerns about his autism spectrum disorder. This lenient penalty drew scrutiny, leading prosecutors to appeal. The U.S. Court of Appeals for the Fourth Circuit subsequently directed a reevaluation, asserting that the initial sentence failed to meet justice requirements.

Fitzpatrick founded BreachForums in March 2022 as a successor to RaidForums and displayed clear knowledge of the illegal nature of his actions, according to the prosecution. They dismissed concerns regarding his mental health, arguing that they bore little relevance to the severity of his criminal conduct.

Defense attorneys noted that Fitzpatrick had complied with the terms of his earlier sentence by refraining from tech use for the past year and undergoing mental health treatment. They argued that his significant autism spectrum disorder, history of suicidality, and related mental health issues could exacerbate risks in a federal prison setting.

During its operation, BreachForums established itself as a dominant hub for English-speaking cybercriminals engaged in the sale of stolen data. Notably, hackers used the forum to distribute sensitive information, including data from an online health insurance marketplace frequented by U.S. lawmakers. The forum became a vital resource for cybercriminal operations, allowing members to buy and sell information from various compromised sources.

Following Fitzpatrick’s arrest, several cybercriminals have attempted to replicate BreachForums’ role in the online underworld, creating successor forums to cater to similar activities. Some of these forums have gained traction, though law enforcement continues to pursue and dismantle such operations actively.