BreachForums Admin Avoids Prison Term

A federal judge sentenced “Pompompurin,” the administrator of a now-defunct data breach marketplace, to 20 years of supervised release. The Peekskill, N.Y. man avoided a recommended 15-year prison sentence for his role in BreachForums, once considered the largest English-language data breach forum of its kind.

See Also: OnDemand | Integrating Splunk and Panther for Real-Time Alerting and Custom Dashboarding

Ransomware monitor vx-underground first reported that Conor Brian Fitzpatrick will not go to prison and that he has been awarded “a profoundly kind sentence from the Honorable Judge Brinkema” of the U.S. Eastern District Court of Virginia.

“More details will be present on PACER on Monday or Tuesday when the court deputy enters the information into their system,” vx-underground reported.

Federal authorities arrested Fitzpatrick, then 20 years old, in March 2023 and say he admitted to running BreachForums.

A day before sentencing, prosecutors recommended recommended a 15-year prison sentence for Fitzpatrick.

Earlier this month, the former administrator of the data breach marketplace was jailed for violations of his presentencing release.

Two FBI agents arrested him after his probation officer alerted the court that the defendant violated his release conditions by using a computer that didn’t have court-required monitoring software installed and by accessing VPN services, according to a court filing.

Fitzpatrick pleaded guilty on July 13, 2023, to a three-count criminal indictment that charged him with conspiracy to commit access device fraud, solicitation for the purpose of offering access devices and possession of child pornography.

The first two charges each carry a prison sentence of up to 10 years, a fine of up to $250,000 and three years of supervised release. The child pornography possession charge carries a maximum penalty of 20 years’ imprisonment, as well as a supervised release period comprising a minimum of five years and a maximum of life.

Under the terms of his plea deal, Fitzpatrick cannot be further charged in the Eastern District of Virginia, but he will have to register as a sex offender following his release from prison.

Fitzgerald launched the now-defunct BreachForums, accessible via breached.co, in March 2022 as a replacement for the notorious RaidForums site after it had been shut down by law enforcement the prior month.

Operating under the handle Pompompurin, Fitzpatrick managed BreachForums and generated close to $700,000 within a year. The majority of this income was derived from forum users who bought credits to access illicitly obtained data.

Prosecutors revealed that when BreachForums finally shut down, it boasted a membership of over 333,000 individuals and hosted a staggering 14 billion leaked records sourced from 888 databases. An affidavit supporting a criminal complaint submitted to the court stated, “Fitzpatrick’s victims have included millions of United States citizens.”

Bleeping Computer reported that as part of his sentencing conditions, Fitzpatrick will spend the initial two years of his release under house arrest, monitored by a GPS locator, and undergo mental health treatment.

During the first year of his supervised release, Fitzpatrick is prohibited from accessing the internet, and his computer will have monitoring software installed by the probation officer.

After this period, Fitzpatrick will be restricted from selling or offering to sell any items on the Internet without prior approval from the court or probation officer. This restriction includes activities such as selling items on internet auction sites.