The Westchester Man Who Founded One Of The World's Largest Hacker Forums Gets Harsher Sentence

PEEKSKILL, NY — A Westchester hacker who avoided prison on federal charges, will go to prison after a new sentence was ordered by a higher court.

The Hudson Valley man was resentenced this week to three years in prison for his creation and operation of a marketplace for cybercriminals to buy, sell, and trade hacked or stolen data and other contraband, and for possessing child sexual abuse material. His resentencing was due to the U.S. Court of Appeals for the Fourth Circuit issuing an opinion on January 21, vacating his prior sentence of time served (17 days), and remanding the case for resentencing.

Conor Brian Fitzpatrick, 22, of Peekskill, pleaded guilty to access device conspiracy, access device solicitation, and possession of child sexual abuse material. He also agreed to forfeit over one hundred domain names used in the operation of the marketplace, over a dozen electronic devices used to carry out the scheme, and cryptocurrency representing proceeds of the scheme.

"Conor Fitzpatrick personally profited from the sale of vast quantities of stolen information, ranging from private personal information to commercial data," U.S. Attorney for the Eastern District of Virginia Erik Siebert said. "These crimes were so extensive that the damage is difficult to quantify, and the human cost of his collection of child sexual abuse material is incalculable. We will not allow criminals to hide in the darkest corners of the internet and will use all legal means to bring them to justice."

BreachForums, started in March 2022, quickly developed into one of the world's largest English-language hacking forums with over 330,000 members. It served as a replacement for RaidForums, a major English-language hacking forum that law enforcement seized in February 2022.

Similar to its predecessor, BreachForums also sold access to high-profile database breaches that contained, among other things, bank account information, social security numbers and other personal identifying information, and usernames and associated passwords for accessing online accounts with merchants and service providers.

"Following the dismantlement of RaidForums by law enforcement, the defendant set up and administered BreachForums, an online bazaar where criminals could purchase sensitive data," said Matthew R. Galeotti, Acting Assistant Attorney General of the Justice Department's Criminal Division. "Today's sentence demonstrates the Justice Department's unwavering commitment to bringing to justice those who seek to sell stolen data to the highest bidder. To those seeking to operate a similar forum, take note: we will tirelessly investigate those who commit these crimes."

BreachForums also maintained and offered access to at least 888 datasets of stolen information with over 14 billion individual records of personal identifying information. Some of the stolen datasets contained customers' sensitive information at telecommunication, social media, investment, health care services, and internet service providers. For example, one database contained the names and contact information for around 200 million users of a major U.S.-based social networking site. Another database offered the details of 87,760 members of InfraGard, a partnership between the FBI and private sector companies for the protection of critical infrastructure.

"Today's sentencing sends a message to everyone in the cybercriminal ecosystem — helping others profit from theft, fraud, and other cybercrimes will land you in federal prison," said Assistant Director Brett Leatherman of the FBI's Cyber Division. "The FBI is working tirelessly to dismantle criminal marketplaces like BreachForums, and we are pursuing the full range of actors who run these platforms."

CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals, and court orders for the return of over $350 million in victim funds.

Assistant U.S. Attorney Lauren Halper and former Assistant U.S. Attorney Carina A. Cuellar for the Eastern District of Virginia and Trial Attorney Thomas Dougherty for CCIPS of the Justice Department's Criminal Division prosecuted this case.

The case was investigated by the FBI Washington Field Office, Health and Human Services-Office of Inspector General, and the FBI San Francisco Division, with assistance provided by the U.S. Secret Service, the Homeland Security Investigations New York Field Office, the New York Police Department, the U.S. Postal Inspection Service, Police Scotland, the National Police Corps of the Netherlands and the Peekskill Police Department. The U.S. Attorneys' Offices for the Northern District of California, the District of Maryland, and the Southern District of New York also provided assistance in this matter.

This case was brought as part of Project Safe Childhood, a nationwide initiative launched in May 2006 by the Department of Justice to combat the growing epidemic of child sexual exploitation and abuse. Led by U.S. Attorneys' Offices and the Child Exploitation and Obscenity Section (CEOS), Project Safe Childhood marshals federal, state, and local resources to better locate, apprehend, and prosecute individuals who exploit children via the internet, as well as to identify and rescue victims. Find more information about Project Safe Childhood, here.