BreachForums Admin Resentenced to 3 Years Over CSAM and Cybercrime

The U.S. Department of Justice (DoJ) on Tuesday resentenced Conor Brian Fitzpatrick, former administrator of BreachForums, to three years in prison for his role in running the cybercrime forum and possessing child sexual abuse material (CSAM).

Fitzpatrick, 22, from Peekskill, New York, also known by the alias Pompompurin, pleaded guilty to access device conspiracy, access device solicitation, and possession of CSAM. He was first arrested in March 2023 and pleaded guilty in July of the same year.

As part of his plea agreement, Fitzpatrick forfeited over 100 domain names used to run BreachForums, more than a dozen electronic devices, and cryptocurrency representing illicit proceeds.

“Conor Fitzpatrick personally profited from the sale of vast quantities of stolen information, ranging from private personal data to commercial records,” said U.S. Attorney Erik S. Siebert. “The human cost of his collection of child sexual abuse material is incalculable. Criminals cannot hide in the darkest corners of the internet.”

Resentencing Background

The resentencing follows a Fourth Circuit Court of Appeals decision on January 21, 2025, which vacated Fitzpatrick’s prior sentence of 17 days time served and remanded the case. His initial January 2024 sentence included time served and 20 years of supervised release.

About BreachForums

BreachForums was launched in March 2022 after law enforcement shut down RaidForums. It became a major cybercrime marketplace, enabling actors to buy, sell, and trade stolen data from high-profile companies. At its peak, the forum had 330,000 members and held over 14 billion records.

Despite multiple shutdown efforts, the forum repeatedly resurfaced under new domains. In July 2024, the original database was leaked online, exposing member information.

Following Fitzpatrick’s arrest, the group ShinyHunters claimed BreachForums had been compromised and was under law enforcement control. As of now, the forum’s latest domain has gone offline, joining 14 other e-crime groups like LAPSUS$ and Scattered Spider in going “dark.”