The administrator and founder of BreachForums has been remanded to custody for violating the terms of his release by accessing the web on a device that didn’t have court-mandated monitoring software and using virtual private network (VPN) services to hide his tracks.
Court documents released on Jan. 2 show that Conor Brian Fitzpatrick, known in the cybercrime world as “Pompompurin,” will remain in custody until he is sentenced on Jan. 19.
BreachForums, a massive platform that allowed users to buy and sell stolen data and other illegal items, was shut down in March 2023 following Fitzpatrick’s initial arrest.
The Downfall of a 20-Year-Old Cybercrime Kingpin
In March 2023, the U.S. Department of Justice (DoJ) charged Fitzpatrick, aged 20 at the time, with orchestrating high-profile cybercrimes. He reportedly made hundreds of thousands of dollars annually from the forum.
“Fitzpatrick’s alleged victims have included millions of U.S. citizens and hundreds of U.S. and foreign companies, organizations, and government agencies,” the DoJ said.
According to the DoJ, Fitzpatrick’s platform hosted over 14 billion records, including sensitive information from various sources. This includes personal details from U.S. social media users, confidential data from an FBI-affiliated program, and a diverse range of information from telecommunication, healthcare, and financial companies.
After Fitzpatrick’s arrest, BreachForums was briefly rebooted by a user named “Baphomet,” who eventually shut it down again after spotting suspicious activity. In an interview last year with Data Knight, Fitzpatrick said he made plans for the forum to be relaunched in the event of a law enforcement takedown.
“If I get arrested one day, it also wouldn’t surprise me, but as I said, I have a trusted person who will have full access to everything needed to relaunch it [the forum] without me. This person will also never be made known to the public, so it wouldn’t be possible for the police to also target them in the event that they want to get the forum taken down for good,” he said.
Now, Fitzpatrick faces the possibility of decades in prison not only for violating the terms of his pretrial release but also due to the serious nature of the charges initially brought against him. These include conspiracy to commit access device fraud, solicitation for the purpose of offering access devices, and possession of child pornography.
Fitzpatrick’s Security Missteps
Fitzpatrick fell onto the radar of law enforcement primarily due to bizarre security missteps. Namely, using easily traceable VPN services and maintaining identifiable email addresses with variations of his name. Other errors include openly discussing his email addresses in online conversations and having Google Pay accounts linked to these email addresses, both of which were connected to a phone number he owned, further compromising his anonymity.
A March 2023 FBI affidavit revealed that despite Fitzpatrick’s use of various VPN services, there were occasions where his real IP address was exposed. This was potentially due to misconfigurations that led to IP leaks.
For instance, logins from VPN companies “including M247 Ltd, Datacamp Limited, Tzulo, Performive, Blix Solutions, Sharktech, Hosting Services Inc, QuadraNet, IVPN, and Mullvad,” were tied to Fitzpatrick, the affidavit said.
The affidavit also revealed that, on at least one occasion, an IP address registered under Fitzpatrick’s father’s name was used to access his account on BreachForums.
Adding to these lapses, unlike many infamous cybercrime forums that operate in the obscurity of the dark web, the original BreachForums site was also accessible through a standard web URL. In fact, at the time of writing, a website with the same name is still online, though with a different suffix.
Staying Anonymous Online
Since 2022, law enforcement agencies have intensified their crackdown on dark web marketplaces. In April 2022, the U.S. Department of Justice shut down Hydra Market, the largest dark web marketplace at the time. Following this, “Operation Cookie Monster,” a joint international operation, led to the closure of Genesis Market.
Fitzpatrick’s case highlights how anonymity tools like VPNs, while designed for privacy and security, can be misused for illegal activities.
Looking for trusted VPNs that can improve your online security and hide your tracks from hackers and other snooping parties? Our VPN experts test dozens of VPNs every year. Check out our guide to the top-rated VPNs for our top picks.
For more news, follow us on X (Twitter), Threads, and Mastodon!
