BreachForums Admin Jailed for Violating Bail Conditions by Using Internet and VPN

According to court documents released last week, the administrator of the now-defunct hacker site BreachForums was arrested and jailed for violating the terms of his bail. Conor Brian FitzPatrick, the owner and founder of BreachForums (also known as Breached) and known online as Pompompurin, was originally arrested in March of last year. Shortly after, law enforcement shut down the site, seized the BreachForums domains and FitzPatrick’s personal website, and later reported gaining access to the site’s database.

Who Is Pompompurin?

Pompompurin was previously involved in hacking companies and then selling or leaking stolen data on the black market. He was also an active member of the hacker forum RaidForums. After the FBI shut down RaidForums in 2022, Pompompurin decided to create his own site—BreachForums. This platform quickly became the largest hacker forum dedicated to data leaks and was frequently used by hackers and extortionists to share stolen information.

In addition to creating BreachForums, Pompompurin is known for several high-profile hacks. Notably, at the end of 2021, following a conflict with cybersecurity expert Vinny Troia, he hacked FBI email servers and sent out fake cyberattack warnings, falsely claiming Troia was responsible. Pompompurin has also been linked to the theft of data from millions of Robinhood users, the leak of data from 5.4 million Twitter users, and other major incidents.

Legal Proceedings and Charges

After his arrest, FitzPatrick faced numerous charges, including stealing and selling confidential personal information belonging to “millions of U.S. citizens and hundreds of American and foreign companies, organizations, and government agencies,” conspiracy to commit access device fraud, inciting access device fraud, and even possession of child pornography on one of his devices. The former BreachForums admin pleaded guilty to all three main charges.

While awaiting sentencing, FitzPatrick was released on $300,000 bail. His sentencing was initially scheduled for November 17 but was later postponed to January 19, 2024. In May of last year, FitzPatrick attempted suicide, and in October, his lawyers requested a delay in sentencing so that experts could assess his mental health. Ultimately, FitzPatrick agreed to a plea deal, but the court imposed a long list of restrictions as bail conditions. These included:

• No access to computers or the internet unless a special monitoring program was installed on the device;
• No use of VPNs, proxies, or Tor;
• No creation, registration, or renting of any new websites;
• No contact with minors under 18 years old;
• No access to any sites or accounts related to hacking, data leaks or theft, computer hacking, security research, malware, programming, domains, cybercrime, online obfuscation, or computer networks without prior approval from probation.

Jailed for Violating Bail Terms

On January 2, 2024, FitzPatrick was re-arrested for violating these conditions and is now in jail awaiting sentencing. According to court documents, Pompompurin accessed the internet from devices without the required monitoring software and continued to use VPN services.

The maximum penalty for the charges against FitzPatrick is 40 years in prison, a $750,000 fine, and, even after release, he will be subject to supervision for at least five years or possibly for life (due to the child pornography charge).