BreachForums founder resentenced to three years in prison

A man who pleaded guilty in 2023 for charges related to his work as founder and operator of the notorious BreachForums website was resentenced Tuesday to three years in prison after having his initial sentence overturned in January.

Conor Brian Fitzpatrick, 22, operated BreachForums — once regarded as the largest English-language cybercrime marketplace — under the alias “Pompompurin.” The forum allowed users to purchase, sell, and exchange hacked or stolen data and other illicit materials, including child sexual abuse material, federal authorities said.  

Fitzpatrick pleaded guilty in July 2023 to conspiracy to commit access device fraud, solicitation concerning fraudulent access devices, and possession of child sexual abuse material. Prosecutors from the Eastern District of Virginia originally sought nearly 16 years of imprisonment for the defendant. However, Fitzpatrick was initially given a sentence of 17 days — time served — along with 20 years of supervised release.

Court records reveal that the lenient sentence considered mitigating circumstances, including Fitzpatrick’s autism diagnosis and his youth. The sentencing memo noted that even while legal proceedings were ongoing, Fitzpatrick violated the court’s terms by using a VPN to access online chatrooms via Discord. In those environments, he challenged the legitimacy of his guilty plea, expressed regret over not contesting the charges, and made statements trivializing the sale of sensitive data to foreign interests.

Reaction to these post-plea actions was swift from prosecutors, who appealed the sentence. U.S. Court of Appeals Judge Paul V. Niemeyer, writing the opinion to vacate the original sentence, described Fitzpatrick’s behavior as demonstrating “a lack of remorse,” noting that the district court “never addressed the seriousness of his crimes or explained how its sentence fulfilled” the legal requirements.

With the appellate court’s decision, the case was returned for resentencing. In addition to the prison sentence, Fitzpatrick was ordered to forfeit over 100 domain names used in connection with BreachForums, more than a dozen electronic devices, and cryptocurrency proceeds from the site’s activity.

BreachForums rose to prominence quickly after law enforcement dismantled RaidForums, then the major English-language hacking platform, in February 2022. BreachForums launched the following March and by most accounts, immediately filled the void left in RaidForums’ absence, accumulating over 330,000 members in less than a year and containing more than 14 billion individual records of personal information, according to court documents.

Since Fitzpatrick’s arrest, law enforcement has attempted to remove BreachForums from the internet, only to see copycats return in the wake of each takedown.