Original BreachForums Admin Gets 3-Year Prison Sentence

Conor Brian Fitzpatrick, founder and administrator of the first iteration of the BreachForums cybercrime forum, received a three year prison sentence during a Tuesday resentencing in a Virginia federal court.

See Also: Why Cyberattackers Love ‘Living Off the Land’

The sentence is far lower than the nearly 16 years prosecutors said was necessary to stop Fitzpatrick, 22, from returning to a life of digital crime and for sending a message to other would-be online crime kingpins. Fitzpatrick proposed one year worth of weekends spent in jail along with 15 years’ probation and 20 years of supervised release.

Better known online as “Pompompurin,” 22-year-old Fitzpatrick pleaded guilty in July 2023 to three criminal counts – two counts related to access device fraud, and one count of possession of child sexual abuse material.

Fitzpatrick’s crimes were so extensive “that the damage is difficult to quantify, and the human cost of his collection of child sexual abuse material is incalculable,” said U.S. Attorney Erik S. Siebert for the Eastern District of Virginia. “We will not allow criminals to hide in the darkest corners of the internet and will use all legal means to bring them to justice.”

Federal agents arrested Fitzpatrick in his parent’s Hudson Valley house in the early hours of March 15, 2023, after linking him to his online moniker. Fitzpatrick and co-conspirators hired to administer BreachForums earned nearly $700,000 by facilitating the sale of stolen data and from members who paid for credits to access hacked data (see: How BreachForums’ ‘Pompompurin’ Led the FBI to His Home).

U.S. District Judge Leonie M. Brinkema of the Eastern District of Virginia in January 2024 gave Fitzpatrick an initial sentence of 17 days’ worth of time served in jail and two decades of supervised release in a judgment marked by concern for Fitzpatrick’s autism spectrum disorder. Prosecutors appealed and the U.S. Court of Appeals for the Fourth Circuit in January directed Brinkema to impose a stricter sentence. “Simply put, a 17-day sentence does not fulfill those required sentencing purposes and therefore was substantively unreasonable,” wrote a three judge panel.

Fitzpatrick created BreachForums in March 2022 as a successor to the FBI-shuttered RaidForums. “There is also no question that the defendant knew what he was doing was wrong,” prosecutors wrote in a Sept. 8 sentencing memo. Prosecutors also dismissed autism concerns, writing that “the defendant’s mental health conditions have little bearing on his criminal conduct” and that, in any case, Fitzpatrick’s level of impairment is low.

Fitzpatrick’s attorneys in a rival sentencing memo argued that Conor has complied with the conditions of his first sentence by not using any electronic device for 12 months and seeking mental health treatment. “Conor’s significant autism spectrum disorder, history of suicidality – including two prior attempts – and co-occurring mental health conditions make federal prison an acutely dangerous environment,” they argued.

During its year-long run, BreachForums established itself as the premier English-speaking forum for selling and obtaining stolen data. A cybercriminal sold data stolen from an online health insurance marketplace used by members of Congress and residents of Washington, D.C. Another offered contact data of members of FBI public-private cybersecurity forum InfraGard, taken after a hacker posed as a chief executive of an American financial institution.

Following Fitzpatrick’s arrest, hackers behind a number of English-speaking forums – some also called BreachForums – have sought to duplicate its role as a major online gathering place for cybercriminals. One successor version of BreachForums did gain popularity, but French police in June arrested five individuals it accused of running the site (see: French Police Reportedly Bust Five BreachForums Administrators).