A New York man, Conor Brian Fitzpatrick, was resentenced to three years in prison for creating and operating BreachForums, an online marketplace where cybercriminals bought and sold hacked or stolen data as well as other illegal materials. Fitzpatrick was also convicted of possessing child sexual abuse material.
“Conor Fitzpatrick personally profited from the sale of vast quantities of stolen information, ranging from private personal information to commercial data,” said Erik S. Siebert, U.S. Attorney for the Eastern District of Virginia. “These crimes were so extensive that the damage is difficult to quantify, and the human cost of his collection of child sexual abuse material is incalculable. We will not allow criminals to hide in the darkest corners of the internet and will use all legal means to bring them to justice.”
“Following the dismantlement of RaidForums by law enforcement, the defendant set up and administered BreachForums, an online bazaar where criminals could purchase sensitive data,” said Matthew R. Galeotti, Acting Assistant Attorney General of the Justice Department’s Criminal Division. “Today’s sentence demonstrates the Justice Department’s unwavering commitment to bringing to justice those who seek to sell stolen data to the highest bidder. To those seeking to operate a similar forum, take note: we will tirelessly investigate those who commit these crimes.”
“Today’s sentencing sends a message to everyone in the cybercriminal ecosystem — helping others profit from theft, fraud, and other cybercrimes will land you in federal prison,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “The FBI is working tirelessly to dismantle criminal marketplaces like BreachForums, and we are pursuing the full range of actors who run these platforms.”
Fitzpatrick pleaded guilty to access device conspiracy, access device solicitation, and possession of child sexual abuse material. As part of his plea agreement he agreed to forfeit over one hundred domain names used for BreachForums operations along with more than a dozen electronic devices used during his scheme and cryptocurrency representing proceeds from his activities.
His resentencing followed a decision by the U.S. Court of Appeals for the Fourth Circuit on January 21, 2025 that vacated his previous sentence—which had been time served (17 days)—and sent it back for reconsideration.
Court documents show that BreachForums launched in March 2022 after law enforcement seized RaidForums in February 2022. It quickly became one of the largest English-language hacking forums with more than 330,000 members worldwide. The site offered access to at least 888 datasets containing over 14 billion records with personal identifying information such as bank account details and social security numbers belonging both to individuals and customers at companies including telecommunications firms and health care providers; some databases included sensitive information about users at major social networking sites or members involved in partnerships focused on critical infrastructure protection.
The case was prosecuted by Assistant United States Attorney Lauren Halper and former Assistant U.S. Attorney Carina A. Cuellar for the Eastern District of Virginia alongside Trial Attorney Thomas Dougherty from DOJ’s Computer Crime and Intellectual Property Section (CCIPS).
CCIPS works closely with domestic and international agencies as well as private sector partners on cybercrime investigations; since 2020 it has secured convictions against more than 180 cybercriminals while recovering over $350 million for victims.
This prosecution is part of Project Safe Childhood—a nationwide initiative led by U.S. Attorneys’ Offices since May 2006—aimed at fighting child exploitation online through coordination among federal, state, local authorities as well as efforts focused on victim identification.
For further details about Project Safe Childhood visit www.justice.gov/psc.
Related court documents can be found through websites maintained by either the U.S. Attorney’s Office for the Eastern District of Virginia or the District Court for the Eastern District of Virginia, or via PACER using Case No. 1:23-cr-119.
