Article / Archive
Conor Fitzpatrick, the creator and administrator of the BreachForums cybercrime website, was sentenced to 20 years of supervised release Friday.
A federal judged deemed that the first two years of the 20-year sentence will be served as home confinement, according to a sentencing document posted Friday. Fitzpatrick will have no access to the internet for the first year of his home confinement and must register with state sex offender registries.
Fitzpatrick, 21, was originally arrested March 15, 2023, at his family’s hope in Peekskill, N.Y., and admitted to owning and operating BreachForums under the “pompompurin” moniker, according to court records. He was released on a $300,000 bond, but was arrested again on Jan. 2 of this year for violating the conditions of his pretrial release by using a computer without the required monitoring software and using virtual private network (VPN) services.
Fitzpatrick launched BreachForums in March 2022 in the wake of the law enforcement takedown of RaidForums, another popular cybercrime marketplace.
Conor Fitzpatrick [aka @pomp] (Courtesy Alexandria Sheriff’s Office)
Prosecutors in the Eastern District of Virginia sought to imprison Fitzpatrick for 188 months — nearly 16 years — based on the nearly 900 stolen databases, comprising over 14 billion individual records, that were made available to members of the BreachForums website, according to court documents filed earlier this month. Additionally, prosecutors said, at the time of his arrest “he knowingly possessed approximately 26 video files containing visual depictions of minors engaged in sexually explicit conduct, including videos depicting prepubescent minors.”
Fitzpatrick’s attorneys filed their own sentencing recommendation memo under seal, citing “confidential and medical information that the public would not, under any other circumstances, be entitled to see.”
Fitzpatrick pleaded guilty on July 13, 2023, to conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography, according to court records.
“By creating a platform for hackers and fraudsters to connect and conduct business, the defendant made it possible for BreachForums members to commit exponentially more crimes and more sophisticated crimes than any could have done alone,” prosecutors wrote in the memo, adding that the “criminal activity on BreachForums touched nearly ever sector of U.S. society.”
Notable incidents cited by prosecutors in the sentencing recommendation memo included a leak in December 2022 of data pertaining to some 87,760 members of InfraGuard, records related to 200 million users of a U.S.-based social media company and 20 million user records for a company that controls background check services in January 2023, and the posting of tens of thousands of users’s private health insurance information, including members of Congress, in March 2023.
The sentencing recommendation memo also noted multiple instances in which Fitzpatrick served as a middle man for transactions involving stolen data and, in at least one case, advised a BreachForums member on how to monetize stolen data. In another instance, according to prosecutors, Fitzpatrick told a forum user that he would provide falsified information to law enforcement, but said he doubted that “law enforcement would even bother making legal requests to a hacking forum lmao.”
Although inactive for a period of several months, BreachForums was resurrected in June 2023 by a former administrator who worked under Fitzpatrick, and the site quickly reestablished itself as a top English-language cybercrime marketplace. That version of the site remains active.
--
You can see my community post here, but he was also a Kiwifarms member (@pomp). He was banned from the forum as well for being a nonce.
Conor Fitzpatrick, the creator and administrator of the BreachForums cybercrime website, was sentenced to 20 years of supervised release Friday.
A federal judged deemed that the first two years of the 20-year sentence will be served as home confinement, according to a sentencing document posted Friday. Fitzpatrick will have no access to the internet for the first year of his home confinement and must register with state sex offender registries.
Fitzpatrick, 21, was originally arrested March 15, 2023, at his family’s hope in Peekskill, N.Y., and admitted to owning and operating BreachForums under the “pompompurin” moniker, according to court records. He was released on a $300,000 bond, but was arrested again on Jan. 2 of this year for violating the conditions of his pretrial release by using a computer without the required monitoring software and using virtual private network (VPN) services.
Fitzpatrick launched BreachForums in March 2022 in the wake of the law enforcement takedown of RaidForums, another popular cybercrime marketplace.
Conor Fitzpatrick [aka @pomp] (Courtesy Alexandria Sheriff’s Office)
Prosecutors in the Eastern District of Virginia sought to imprison Fitzpatrick for 188 months — nearly 16 years — based on the nearly 900 stolen databases, comprising over 14 billion individual records, that were made available to members of the BreachForums website, according to court documents filed earlier this month. Additionally, prosecutors said, at the time of his arrest “he knowingly possessed approximately 26 video files containing visual depictions of minors engaged in sexually explicit conduct, including videos depicting prepubescent minors.”
Fitzpatrick’s attorneys filed their own sentencing recommendation memo under seal, citing “confidential and medical information that the public would not, under any other circumstances, be entitled to see.”
Fitzpatrick pleaded guilty on July 13, 2023, to conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography, according to court records.
“By creating a platform for hackers and fraudsters to connect and conduct business, the defendant made it possible for BreachForums members to commit exponentially more crimes and more sophisticated crimes than any could have done alone,” prosecutors wrote in the memo, adding that the “criminal activity on BreachForums touched nearly ever sector of U.S. society.”
Notable incidents cited by prosecutors in the sentencing recommendation memo included a leak in December 2022 of data pertaining to some 87,760 members of InfraGuard, records related to 200 million users of a U.S.-based social media company and 20 million user records for a company that controls background check services in January 2023, and the posting of tens of thousands of users’s private health insurance information, including members of Congress, in March 2023.
The sentencing recommendation memo also noted multiple instances in which Fitzpatrick served as a middle man for transactions involving stolen data and, in at least one case, advised a BreachForums member on how to monetize stolen data. In another instance, according to prosecutors, Fitzpatrick told a forum user that he would provide falsified information to law enforcement, but said he doubted that “law enforcement would even bother making legal requests to a hacking forum lmao.”
Although inactive for a period of several months, BreachForums was resurrected in June 2023 by a former administrator who worked under Fitzpatrick, and the site quickly reestablished itself as a top English-language cybercrime marketplace. That version of the site remains active.
--
You can see my community post here, but he was also a Kiwifarms member (@pomp). He was banned from the forum as well for being a nonce.
The defendant shall not have any intentional contact with any child under the age of 18, except for his brother, Brendan Fitzpatrick, unless accompanied by a responsible adult who is aware of the defendant's conviction and supervision status and who has been approved in advance by the court or probation officer. Intentional contact includes, but is not limited to, physical contact, verbal communication, written communication, and/or electronic communication such as e-mail. Intentional contact also includes going to, congregating and/or loitering within 100 yards around school yards, playgrounds, swimming pools, arcades, zoos, or other places frequented by children under the age of 18. Intentional contact also encompasses any employment that would regularly provide the defendant with access to children under the age of 18, such as working in schools, childcare facilities, amusement parks and playgrounds. Incidental contact with children under the age of 18 includes, but is not limited to, unavoidable interactions in public places such as grocery stores, department stores, restaurants, etc.9)Pursuant to the Adam Walsh Child Protection and Safety Act of 2006, the defendant shall register with the state sex offender registration agency in any state where the defendant resides, works, and attends school, according to federal and state law and as directed by the probation officer.10)Pursuant to the Adam Walsh Child Protection and Safety Act of 2006, the defendant shall submit their person, property, house, residence vehicle, papers, computers (as defined in 18 U.S.C. § 1030(e)(1)), other electronic communications or data storage devices or media, or office, to a search conducted by a United States probation officer. Failure to submit to a search may be grounds for revocation of release. The defendant must warn any other occupants that the premises may be subject to searches pursuant to this condition. The probation officer may conduct a search under this condition only when reasonable suspicion exists that the defendant has violated a condition of supervision and that the areas to be searched contain evidence of this violation. Any search must be conducted at a reasonable time and in a reasonable manner.11)The defendant shall disclose to the probation office all computers as defined in 18 U.S.C. § 1030(e)(1), and similar devices that provide access to the Internet, that the defendant owns, possesses, or uses. The defendant shall not possess or use any computer or similar device, which includes use of computers at work, unless the defendant cooperates with the probation office's computer monitoring program or receives permission from the probation office. The defendant shall permit random, unannounced inspections on any unmonitored computer or similar device under the defendant's control to ensure compliance. The defendant shall not use the Internet to communicate with any individual or group who promotes sexual abuse of children.12)The defendant shall comply with the requirements of the computer monitoring program as administered by the probation office. The defendant shall allow the probation officer to install computer monitoring software on any computer (as defined in 18 U.S.C. § 1030(e)(1)) the defendant uses. The costs of monitoring shall be paid by the defendant. To ensure compliance with the computer monitoring condition, the defendant shall allow the probation officer to conduct initial and periodic unannounced searches of any computers (as defined in 18 U.S.C. § 1030(e)(1)) subject to computer monitoring. These searches shall be conducted to determine whether the computer contains any prohibited data prior to installation of the monitoring software, whether the monitoring software is functioning effectively after its installation, and whether there have been attempts to circumvent the monitoring software after its installation. The defendant shall warn any other people who use these computers that the computers may be subject to searches pursuant to this condition. The defendant shall allow the probation officer to install computer monitoring software on any computer (as defined in 18 U.S.C. § 1030(e)(1)) the defendant seeks to use. The defendant shall submit to a search of all computers (as defined in 18 U.S.C. § 1030(e)(1)) or other electronic communications or data storage devices or media. The defendant shall warn any other people who use these computers or devices capable of accessing the Internet that the devices may be subject to searches pursuant to this condition. A probation officer may conduct a search pursuant to this condition only when reasonable suspicion exists that there is a violation of a condition of supervision and that the computer or device contains evidence of this violation. Any search will be conducted at a reasonable time and in a reasonable manner. To ensure compliance with computer monitoring or supervision conditions, the defendant shall submit any records requested by the probation officer to verify compliance with the defendant's conditions including, but not limited to, credit card bills, telephone bills, and cable/satellite television bills.13)The defendant shall, at the direction of the probation officer, notify his employer of: (1) the nature of his/her conviction; and (2) the fact that the defendant's conviction, related conduct, or prior criminal history was facilitated by the use of a computer and/or Internet. The defendant's employment shall be approved in advance by Probation and the Probation Office shall confirm the defendant's compliance with this notification requirement and possible Internet monitoring of his/her computer at employment.14)The defendant shall not have any access to the internet within the first year of his supervised release. After that year the defendant shall not sell or offer to sell any item on the internet for another person or entity without pre-approval and authorization from the court or probation officer. This includes, but is not limited to, selling items on internet auction sites.Restitution to be determined at a later date. No fines/costs of incarceration/costs of supervision imposed. $300 SA ($100 on ea. ct.). Defendant advised he may have the right to appeal.Defendant remanded. Court Reporter: R. Stonestreet(tran) (Main Document 72 replaced on 1/19/2024) (tran, ). (Entered: 01/19/2024)
