A New York man, Conor Brian Fitzpatrick, was resentenced to three years in prison for creating and operating BreachForums, a major online marketplace used by cybercriminals to buy, sell, and trade hacked or stolen data and other contraband. Fitzpatrick also possessed child sexual abuse material.
Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia, said: “Conor Fitzpatrick personally profited from the sale of vast quantities of stolen information, ranging from private personal information to commercial data. These crimes were so extensive that the damage is difficult to quantify, and the human cost of his collection of child sexual abuse material is incalculable. We will not allow criminals to hide in the darkest corners of the internet and will use all legal means to bring them to justice.”
Matthew R. Galeotti, Acting Assistant Attorney General of the Justice Department’s Criminal Division stated: “Following the dismantlement of RaidForums by law enforcement, the defendant set up and administered BreachForums, an online bazaar where criminals could purchase sensitive data. Today’s sentence demonstrates the Justice Department’s unwavering commitment to bringing to justice those who seek to sell stolen data to the highest bidder. To those seeking to operate a similar forum, take note: we will tirelessly investigate those who commit these crimes.”
Assistant Director Brett Leatherman of the FBI’s Cyber Division added: “Today’s sentencing sends a message to everyone in the cybercriminal ecosystem — helping others profit from theft, fraud, and other cybercrimes will land you in federal prison. The FBI is working tirelessly to dismantle criminal marketplaces like BreachForums, and we are pursuing the full range of actors who run these platforms.”
Fitzpatrick pleaded guilty to access device conspiracy, access device solicitation, and possession of child sexual abuse material. As part of his plea agreement he agreed to forfeit more than one hundred domain names used for BreachForums operations as well as over a dozen electronic devices involved in carrying out his scheme and cryptocurrency obtained through it.
The resentencing follows an opinion issued by the U.S. Court of Appeals for the Fourth Circuit on January 21, 2025 vacating Fitzpatrick's previous sentence—which amounted only to time served—and remanding his case for resentencing.
Court documents show that BreachForums launched in March 2022 after law enforcement seized RaidForums—a leading English-language hacking forum—in February 2022 (https://www.justice.gov/opa/pr/international-law-enforcement-operation-disrupts-notorious-cybercriminal-marketplace-raidforums). BreachForums quickly became one of largest forums worldwide with over 330,000 members. It offered access to high-profile database breaches containing bank account details; social security numbers; usernames; passwords; and other personal identifying information (PII). The site maintained at least 888 datasets with more than 14 billion records—some datasets included sensitive customer information from telecommunications firms; social media companies; investment groups; healthcare services; ISPs—and even details about approximately 200 million users from a major U.S.-based social networking site as well as nearly 88 thousand InfraGard members.
Prosecutors Lauren Halper and Carina A. Cuellar from the Eastern District of Virginia along with Trial Attorney Thomas Dougherty from DOJ's Computer Crime and Intellectual Property Section handled this case.
CCIPS works with domestic/international agencies on cybercrime cases—since 2020 it has secured convictions against over 180 cybercriminals with court orders returning more than $350 million in victim funds (https://www.justice.gov/criminal-ccips/about).
This prosecution is part of Project Safe Childhood—a DOJ initiative started in May 2006 focused on combating child exploitation online through collaboration among federal/state/local agencies (https://www.justice.gov/psc).
Further details are available on websites for both U.S. Attorney’s Office for Eastern District of Virginia and District Court for Eastern District or via PACER under Case No. 1:23-cr-119.
