Conor Brian Fitzpatrick, aka ‘Pompompurin,’ was resentenced to three years in federal prison for creating and operating BreachForums, a now-defunct online marketplace used by cybercriminals to traffic in hacked and stolen data, as well as for possessing child sexual abuse material (CSAM).
Conor Brian Fitzpatrick pleaded guilty to one count of access device conspiracy, one count of access device solicitation, and one count of possession of CSAM. The resentencing follows a January 21, 2025, decision by the US Court of Appeals for the Fourth Circuit, which vacated his original sentence of time served (17 days) and remanded the case for reconsideration.
According to court documents, Fitzpatrick launched BreachForums in March 2022 after the takedown of the RaidForums hacking platform. In less than a year, BreachForums became one of the world’s largest English-language hacking forums, amassing over 330,000 members. The site offered access to more than 888 stolen datasets comprising over 14 billion individual records, including names, Social Security numbers, bank account information, login credentials, and other forms of personal identifying information (PII).
Some breaches involved highly sensitive information. One leaked database contained contact information for approximately 200 million users of a major US-based social networking platform, while another revealed details of nearly 88,000 members of InfraGard, an FBI-affiliated partnership with private-sector firms tasked with protecting critical infrastructure.
As part of his plea deal, Fitzpatrick agreed to forfeit more than 100 domain names used in the operation of BreachForums, over a dozen electronic devices, and cryptocurrency proceeds connected to the scheme.
In addition to trafficking stolen data, Fitzpatrick was also found in possession of CSAM. Fitzpatrick is expected to serve his sentence in a federal correctional facility, followed by a period of supervised release.