#BreachForums Operator Sentenced to Three Years in Prison

A New York man, Conor Brian Fitzpatrick, has been resentenced to three years in prison for his role in operating BreachForums, a notorious online marketplace where cybercriminals bought, sold, and traded stolen data and other illicit goods.

#The Investigation and Charges

The investigation into BreachForums began after law enforcement dismantled RaidForums, a similar platform, in February 2022. Fitzpatrick, 22, of Peekskill, New York, was arrested and charged with multiple counts, including access device conspiracy, access device solicitation, and possession of child sexual abuse material.

#The Crimes

BreachForums, launched in March 2022, quickly became one of the world's largest English-language hacking forums, with over 330,000 members. The platform was used to sell access to high-profile database breaches containing sensitive information, including:

• Bank account information
• Social security numbers
• Personal identifying information (PII)
• Usernames and associated passwords for accessing online accounts with merchants and service providers

The platform maintained and offered access to at least 888 datasets of stolen information, containing over 14 billion individual records of PII. Some of the stolen datasets contained sensitive information of customers at:

• Telecommunication companies
• Social media platforms
• Investment firms
• Health care services
• Internet service providers

#The Impact

The impact of BreachForums was significant, with one database containing the names and contact information for approximately 200 million users of a major U.S.-based social networking site. Another database listed the details of approximately 87,760 members of InfraGard, a partnership between the FBI and private sector companies focused on the protection of critical infrastructure.

#The Sentence

Fitzpatrick's resentencing follows an appeal that vacated his previous sentence of 17 days. As part of his plea agreement, he agreed to forfeit over 100 domain names, electronic devices, and cryptocurrency related to the operation.

#The Prosecution

The FBI's Washington Field Office investigated the case, which was prosecuted by the Justice Department's Computer Crime and Intellectual Property Section and the U.S. Attorney's Office for the Eastern District of Virginia.

#The Justice Department's Efforts

This case is part of the Justice Department's efforts to disrupt and dismantle online marketplaces used for cybercrime, as well as Project Safe Childhood, a nationwide initiative to combat child sexual exploitation and abuse. The Justice Department is committed to bringing to justice those who seek to sell stolen data to the highest bidder and to protecting the public from cybercrime.