Conor Brian Fitzpatrick, who founded and oversaw BreachForums, received a sentence of time served and 20 years of supervised release.
Fitzpatrick, also known online as “pompompurin,” was detained in New York in March 2023 and charged with possessing child pornography and conspiring to commit access device fraud. After posting a $300,000 bond and entering a guilty plea to the charges in July 2023, he was eventually freed.
Since March 2022, BreachForums has been a prominent cybercrime marketplace that has enabled the trafficking of stolen data. Before the website was shut down precisely a year later, it had more than 340,000 members.
Bank account details, Social Security numbers, personally identifiable information (PII), hacking tools, penetrated databases, and account login credentials for hacked online accounts with service providers and retailers were among the stolen goods that were frequently traded on the platform.
Additionally, BreachForums promoted services for breaking into victim systems without authorization. It is estimated that the incident affected hundreds of domestic and international businesses, organisations, and government bodies in addition to millions of American citizens.
Furthermore, Fitzpatrick ran a “Leaks Market,” serving as a reliable go-between (or escrow) for users of the website looking to exchange tools, other illegal materials, and data that had been compromised or stolen.
“In addition, Fitzpatrick allegedly managed a ‘Official’ databases section through which BreachForums directly sold access to verified hacked databases through a “credits” system administered by the platform,” the U.S. Department of Justice claimed.
Fitzpatrick may have avoided a prison sentence in part due to his mental health, according to court documents that DataBreaches.net was able to get. Prosecutors suggested a 15-year prison sentence for the defendant one day prior to sentencing.
It is anticipated that the 21-year-old would receive mental health therapy and serve the first two years of supervised release under home arrest equipped with a GPS location tracker. In addition, he must register with the state sex offender registration agency in each state where he resides and forgo using the internet for the first year.