Jailed BreachForums creator, admin sentenced to 20 years of supervised release

Conor Fitzpatrick created and ran a notorious website used to facilitate online crime and leak sensitive data.

Conor Fitzpatrick, the creator and administrator of the BreachForums cybercrime website, was sentenced to 20 years of supervised release Friday.

A federal judge deemed that the first two years of the 20-year sentence will be served as home confinement, according to a sentencing document posted Friday. Fitzpatrick will have no access to the internet for the first year of his home confinement and must register with state sex offender registries.

Fitzpatrick, 21, was originally arrested March 15, 2023, at his family’s hope in Peekskill, N.Y., and admitted to owning and operating BreachForums under the “pompompurin” moniker, according to court records. He was released on a $300,000 bond, but was arrested again on Jan. 2 of this year for violating the conditions of his pretrial release by using a computer without the required monitoring software and using virtual private network (VPN) services.

Fitzpatrick launched BreachForums in March 2022 in the wake of the law enforcement takedown of RaidForums, another popular cybercrime marketplace.

Prosecutors in the Eastern District of Virginia sought to imprison Fitzpatrick for 188 months — nearly 16 years — based on the nearly 900 stolen databases, comprising over 14 billion individual records, that were made available to members of the BreachForums website, according to court documents filed earlier this month. Additionally, prosecutors said, at the time of his arrest “he knowingly possessed approximately 26 video files containing visual depictions of minors engaged in sexually explicit conduct, including videos depicting prepubescent minors.”

Fitzpatrick’s attorneys filed their own sentencing recommendation memo under seal, citing “confidential and medical information that the public would not, under any other circumstances, be entitled to see.”

Fitzpatrick pleaded guilty on July 13, 2023, to conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography, according to court records.

“By creating a platform for hackers and fraudsters to connect and conduct business, the defendant made it possible for BreachForums members to commit exponentially more crimes and more sophisticated crimes than any could have done alone,” prosecutors wrote in the memo, adding that the “criminal activity on BreachForums touched nearly ever sector of U.S. society.”

Notable incidents cited by prosecutors in the sentencing recommendation memo included a leak in December 2022 of data pertaining to some 87,760 members of InfraGuard, records related to 200 million users of a U.S.-based social media company and 20 million user records for a company that controls background check services in January 2023, and the posting of tens of thousands of users’s private health insurance information, including members of Congress, in March 2023.

The sentencing recommendation memo also noted multiple instances in which Fitzpatrick served as a middle man for transactions involving stolen data and, in at least one case, advised a BreachForums member on how to monetize stolen data. In another instance, according to prosecutors, Fitzpatrick told a forum user that he would provide falsified information to law enforcement, but said he doubted that “law enforcement would even bother making legal requests to a hacking forum lmao.”

Although inactive for a period of several months, BreachForums was resurrected in June 2023 by a former administrator who worked under Fitzpatrick, and the site quickly reestablished itself as a top English-language cybercrime marketplace. That version of the site remains active.

Early 764 member sentenced to 77 years, longest prison term to date for a nihilistic violent extremist

Kyle Spitze led an offshoot of the violent extremist collective and victimized dozens of girls, coercing them to degrade themselves under threats of doxing and swatting.

Tech contractor for Brightly Software sentenced to 2 years in prison for insider attack

Snowflake hacker pleads guilty, faces up to 32 years in prison

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure