BreachForums founder to be resentenced after court vacates previous punishment

A U.S. appeals court has vacated the initial sentence given to Conor Brian Fitzpatrick, who pleaded guilty in 2023 for charges related to his work as founder of the notorious BreachForums website. The appeal, filed by the U.S. government, signals that a new sentence could be much more harsh than the one initially issued last year. 

Fitzpatrick, operating under the pseudonym “Pompompurin,” became a notable figure in the cybercriminal underworld after launching BreachForums in March 2022. Under Fitzpatrick’s oversight, BreachForums amassed over 14 billion individual records, allowing users to sell Social Security numbers, bank details, and other sensitive information, making it the largest English-language cybercrime marketplace to date.

Fitzpatrick pleaded guilty on July 13, 2023, to conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography, according to court records. Prosecutors in the Eastern District of Virginia sought to imprison Fitzpatrick for nearly 16 years, but the courts ultimately decided on time served plus 20 years of supervised release. 

A document filed in court Tuesday found the court chose a lenient sentence, citing a diagnosis of autism and Fitzpatrick’s age as mitigating circumstances. Yet, even while he was going through the legal process, he violated the court’s terms by accessing the internet through a virtual private network and engaging in online chatrooms through the messaging platform Discord. In these chatrooms, he asserted his innocence regarding the crimes he had confessed to in court, labeling his plea deal as “so BS” and expressing regret that he did not contest the charges. He further made light of selling data to foreign nations, encouraging a user to “become a foreign asset to China or Russia” and to “sell government secrets.” 

The government later appealed the sentence, which was vacated Tuesday. 

“Not only did Fitzpatrick commit serious offenses, but he also showed a lack of remorse, joking about committing additional crimes even after entering a guilty plea,” Judge Paul V. Niemeyer wrote in the opinion that vacated Fitzpatrick’s sentence. “Yet, despite Fitzpatrick’s conduct, the district court never addressed the seriousness of his crimes or explained how its sentence fulfilled” the law. 

It is unknown exactly when the resentencing will take place, but it is very likely Fitzpatrick will face a harsher sentence than the one initially given. 

Fitzpatrick’s lawyers did not respond to CyberScoop’s request for comment. 

Since Fitzpatrick’s arrest, law enforcement has attempted to remove BreachForums from the internet, only to see copycats return in the wake of each takedown. 

You can read the full appellate court ruling below.