U.S. Department
of Justice
United States v. Conor Brian Fitzpatrick
United States v. Conor Brian Fitzpatrick, Crim. No. 1:23-mj-67
On March 15, 2023, the defendant Conor Brian Fitzpatrick, 20, of Peekskill, New York, was named in a one-count criminal complaint charging him with conspiracy to commit access device fraud, in violation of 18 U.S.C. § 1029(b), related to his alleged creation and administration of BreachForums. At the time of his arrest, BreachForums was a major hacking forum and marketplace for cybercriminals that claimed to have more than 340,000 members. The defendant was arrested that day and subsequently released on pretrial supervision.
According to the complaint, Conor Brian Fitzpatrick, allegedly operated BreachForums as a marketplace for cybercriminals to buy, sell, and trade hacked or stolen data and other contraband since March 2022. Among the stolen items commonly sold on the platform were bank account information, social security numbers, other personally identifying information (PII), means of identification, hacking tools, breached databases, services for gaining unauthorized access to victim systems, and account login information for compromised online accounts with service providers and merchants.
Fitzpatrick’s alleged victims have included millions of U.S. citizens and hundreds of U.S. and foreign companies, organizations, and government agencies. Some of the stolen datasets contained the sensitive information of customers at telecommunication, social media, investment, health care services, and internet service providers. For instance, on Jan. 4, a BreachForums user posted the names and contact information for approximately 200 million users of a major U.S.-based social networking site. Further, on Dec. 18, 2022, another BreachForums user posted details of approximately 87,760 members of InfraGard, a partnership between the FBI and private sector companies focused on the protection of critical infrastructure.
As part of the scheme, Fitzpatrick allegedly supported the activities of cybercriminals by creating and operating a “Leaks Market” subsection that was dedicated to buying and selling hacked or stolen data, tools for committing cybercrime, and other illicit material. To facilitate transactions on the forum, Fitzpatrick allegedly offered to act as a trusted middleman, or escrow service, between individuals on the website who sought to conduct these types of illicit transactions. In addition, Fitzpatrick allegedly managed an “Official” databases section through which BreachForums directly sold access to verified hacked databases through a “credits” system administered by the platform. As of Jan. 11, the Official database section purported to contain 888 datasets, consisting of over 14 billion individual records. These databases belong to a wide variety of both U.S. and foreign companies, organizations, and government agencies. Fitzpatrick allegedly profited from the scheme by charging for forum credits and membership fees.
If a person or entity believes that their data has been posted, trafficked, or otherwise used without authorization, that person or entity may have been victimized by the alleged activities of the named defendant and his co-conspirators on BreachForums. This court-ordered notice is to help identify any potential victims of the criminal conduct alleged in the Complaint, to provide these victims with information about the government’s investigation, to help victims confer with the prosecution team, and generally to protect victim rights.
Court Documents
Victim Information
Pursuant to the Crime Victims’ Rights Act, 18 U.S.C. § 3771, the Department of Justice is required to provide notice to individuals who may have been harmed as a direct result of the criminal offenses of which a defendant has been convicted. In this context, “harmed” is defined broadly and is not limited to monetary loss. This office uses the Victim Notification System (“VNS”) and other methods, including web pages and press releases, to ensure potential victims receive timely notice of public events related to a case. For more information, go to Victims Rights Act
A different federal law, the Mandatory Victim Restitution Act (“MVRA”), 18 U.S.C. § 3663A, governs restitution in this case. Restitution is a determination by the judge that a victim is entitled to monetary compensation for losses suffered as a direct result of a crime for which a defendant has been convicted. It is not a guarantee of payment. Under the MVRA, if a defendant is convicted of a crime carrying restitution as a penalty, the judge at sentencing determines who is a victim and in what amount they are entitled to restitution. In cases involving property crimes, including the fraud offenses with which the defendant is charged, restitution may generally only be awarded for the value of the property lost by the victim as a direct result of a defendant’s crime of conviction less the value of any property returned to the victim. Victims may also be entitled to restitution for expenses incurred while participating in the criminal investigation or prosecution or traveling to court proceedings for the case, such as lost income, childcare, transportation, and other expenses. Restitution is generally not available for medical care, pain and suffering, emotional distress, or lost income caused by the defendant’s conduct, except in the limited context described above.
Contact Information
The U.S. Department of Justice and the U.S. Attorney’s Office for the Eastern District of Virginia are committed to protecting the rights of crime victims and providing them with information necessary to exercise those rights. We invite those potential crime victims to contact the prosecution through our Victim/Witness Unit to ensure they are notified of important stages of the case. In addition, our Victim/Witness Unit can help make references to agencies that provide other services to witnesses. We suggest that any potential victim fill out the Potential Victim Form and submit it to our Victim/Witness Unit. Those who successfully register as potential victims will have access to the Victim Notification System (“VNS”).
The VNS is designed to provide information regarding the case as it proceeds through the criminal justice system. Registered victims may obtain current information about this matter on the Internet at www.Notify.usdoj.gov or from the VNS Call Center at 1-866-DOJ-4YOU (1-866-365-4968) (TDD/TTY:1-866-228-4619; International 1-502-213-2767). In addition, they may use the Call Center or Internet to update their contact information and/or change their decision about participation in the notification program. In order to access VNS, a crime victim must receive a Victim Identification Number (VIN) and Personal Identification Number (PIN) from our Victim/Witness Unit. Again, to register, please complete the Potential Victim Form and submit it to the email or mailing address below.
To submit a Potential Victim Form or obtain other assistance, please contact:
Victim/Witness Coordinator
United States Attorney’s Office
Justin W. Williams United States Attorney’s Building
2100 Jamieson Ave, Alexandria, Virginia 22314
United States of America
(703) 299-3700
USAVAE.BreachForumVictims@usdoj.gov
Resources
Press Releases
Next Court Date
Not yet set.