BreachForums founder to be resentenced after court vacates previous punishment

Conor Fitzpatrick was initially sentenced to 20 years of supervised release following a guilty plea in July 2023.

A U.S. appeals court has vacated the initial sentence given to Conor Brian Fitzpatrick, who pleaded guilty in 2023 for charges related to his work as founder of the notorious BreachForums website. The appeal, filed by the U.S. government, signals that a new sentence could be much more harsh than the one initially issued last year. 

Fitzpatrick, operating under the pseudonym “Pompompurin,” became a notable figure in the cybercriminal underworld after launching BreachForums in March 2022. Under Fitzpatrick’s oversight, BreachForums amassed over 14 billion individual records, allowing users to sell Social Security numbers, bank details, and other sensitive information, making it the largest English-language cybercrime marketplace to date.

Fitzpatrick pleaded guilty on July 13, 2023, to conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography, according to court records. Prosecutors in the Eastern District of Virginia sought to imprison Fitzpatrick for nearly 16 years, but the courts ultimately decided on time served plus 20 years of supervised release. 

A document filed in court Tuesday found the court chose a lenient sentence, citing a diagnosis of autism and Fitzpatrick’s age as mitigating circumstances. Yet, even while he was going through the legal process, he violated the court’s terms by accessing the internet through a virtual private network and engaging in online chatrooms through the messaging platform Discord. In these chatrooms, he asserted his innocence regarding the crimes he had confessed to in court, labeling his plea deal as “so BS” and expressing regret that he did not contest the charges. He further made light of selling data to foreign nations, encouraging a user to “become a foreign asset to China or Russia” and to “sell government secrets.” 

The government later appealed the sentence, which was vacated Tuesday. 

“Not only did Fitzpatrick commit serious offenses, but he also showed a lack of remorse, joking about committing additional crimes even after entering a guilty plea,” Judge Paul V. Niemeyer wrote in the opinion that vacated Fitzpatrick’s sentence. “Yet, despite Fitzpatrick’s conduct, the district court never addressed the seriousness of his crimes or explained how its sentence fulfilled” the law. 

It is unknown exactly when the resentencing will take place, but it is very likely Fitzpatrick will face a harsher sentence than the one initially given. 

Fitzpatrick’s lawyers did not respond to CyberScoop’s request for comment. 

Since Fitzpatrick’s arrest, law enforcement has attempted to remove BreachForums from the internet, only to see copycats return in the wake of each takedown. 

You can read the full appellate court ruling below. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure