BreachForums hacking forum admin sentenced to 20 years supervised release

Conor Brian Fitzpatrick was sentenced to 20 years of supervised release today in the Eastern District of Virginia for operating the notorious BreachForums hacking forum, known for the sale and leaking of personal data for hundreds of millions of people worldwide.

Fitzpatrick was charged in March 2023 for his involvement in the theft and sale of sensitive personal information belonging to "millions of U.S. citizens and hundreds of U.S. and foreign companies, organizations, and government agencies" on the Breached cybercrime forum.

Operating online under the name "Pompompurin," Fitzpatrick was part of a cybercriminal underground dedicated to breaching companies and selling or leaking their stolen data online.

To facilitate the sale and sharing of stolen data, Fitzpatrick created an online forum called BreachForums, where the data for millions of individuals worldwide was commonly leaked or sold to other threat actors.

Fitzpatrick had previously pleaded guilty to 1 count of Conspiracy to Commit Access Device Fraud, two counts of Solicitation for the Purpose of Offering Access, and three counts of Possession of Child Pornography.

In a sentencing memorandum submitted by U.S. prosecutors on January 16th, the U.S. government sought 188 months, approximately 15.7 years, of imprisonment for Fitzpatrick.

However, as first reported by VX-Underground and later confirmed by BleepingComputer, the courts showed leniency today, sentencing Fitzpatrick to time served and 20 years of supervised release.

As part of the sentencing conditions, Fitzpatrick will serve the first two years of his release in home arrest with a GPS locator and receive mental health treatment.

Fitzpatrick is also prevented from using the internet in his first year of release and must allow the probation officer to install monitoring software on his computer.

"The defendant shall not have any access to the internet within the first year of his supervised release," reads the sentencing judgment.

"After that year the defendant shall not sell or offer to sell any item on the internet for another person or entity without pre-approval and authorization from the court or probation officer. This includes, but is not limited to, selling items on internet auction sites."

The courts require Fitzpatrick to pay restitution for victims' losses, with the amount to be determined at a later date.