The U.S. Department of Justice (DOJ) announced the resentencing of Conor Brian Fitzpatrick, 22, of Peekskill, New York, to three years in prison for his role in creating and operating BreachForums, one of the world’s largest English-language hacking marketplaces. Fitzpatrick was also convicted of possessing CSAM, a crime described by prosecutors as carrying an “incalculable” human toll.
BreachForums, launched in March 2022 after the takedown of RaidForums, became a hub for cybercriminals to buy and sell hacked or stolen data. According to the DOJ, the forum hosted over 888 datasets of stolen information, totaling more than 14 billion individual records. These included bank account details, Social Security numbers, login credentials, and personal data from high-profile breaches.
“Following the dismantlement of RaidForums by law enforcement, the defendant set up and administered BreachForums, an online bazaar where criminals could purchase sensitive data,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.
The scale of the forum was immense. One database offered the names and contact details of 200 million users from a U.S.-based social networking site, while another exposed the personal details of 87,760 members of InfraGard, a public-private cybersecurity partnership run by the FBI.
Fitzpatrick’s resentencing followed a January 2025 ruling by the U.S. Court of Appeals for the Fourth Circuit, which vacated his initial sentence of just 17 days served and ordered resentencing.
As part of his plea agreement, Fitzpatrick agreed to forfeit:
- Over 100 domain names tied to BreachForums’ operations
- More than a dozen electronic devices used in the scheme
- Cryptocurrency proceeds derived from forum transactions