Conor Brian Fitzpatrick, aka “Pompompurin” was re-sentenced today in federal court in Virginia.
The government had sought a prison sentence of at least 188 months for the former owner of the original BreachForums, while the defense sought probation with weekend jail time for a year.
Judge Leonie Brinkema, who had previously sentenced Fitzpatrick to time served plus 20 years supervised release with special conditions, re-sentenced Fitzpatrick after the Fourth Circuit vacated her original sentence as being unreasonable in light of the seriousness of his crimes and the need to send a message of deterrence to others.
Today, Fitzpatrick was sentenced to:
36 months in prison with credit for time served. This term consists of 36 months as to Count 1, 2, and 3, to be served concurrently. Fitzpatrick could have been sentenced to up to 20 years for the child pornography charge (Count 3) alone.
20 year supervised release term imposed with the same conditions previously imposed. This term consists of 2 years supervised release term as to counts 1 and 2, and a 20 year supervised release term as to count 3, to be served concurrently.
Fitzpatrick will shall serve his prison sentence at FCI Danbury Low. He shall be enrolled in the Skills Program.
Fitzpatrick was placed on personal recognizance bond until he surrenders for service of sentence (Order to follow).
FCI Danbury Low is a low security federal correctional institution with an adjacent minimum security satellite camp in Danbury, Connecticut. It is not far from Fitzpatrick’s family, which will make it easier for them to visit him and support him.
The minutes of the hearing (below) do not mention any mental health services, but there may clarification in the order that will follow.
At this time, DataBreaches does not know why Judge Brinkema sentenced Fitzpatrick to 36 months in prison with credit for time served. It is a lot more than her previous sentence that involved no prison time, but it is still a significantly lower sentence than the sentencing guidelines would suggest.
Background of the case and additional details are linked from https://databreaches.net/2025/09/16/conor-brian-fitzpatrick-re-sentenced-three-years-in-prison-plus-20-years-supervised-release-for-former-breachforums-owner/
3 yrs what a joke. the system likes pdfs.
Photon17.09.2025, 11:393 yrs what a joke. the system likes pdfs.
I'm not sure I understand your comment about .pdf's, but so far, everyone who has commented on the sentence has criticized it as being too lenient. I'm wondering what this will do in future cases -- like Omnipotent's if he's ever extradited to the U.S. Instead of a sentence having a deterrent value, I don't think Pom's sentence will deter anyone from doing what he did.
Dissent17.09.2025, 23:20I'm not sure I understand your comment about .pdf's, but so far, everyone who has commented on the sentence has criticized it as being too lenient. I'm wondering what this will do in future cases -- like Omnipotent's if he's ever extradited to the U.S. Instead of a sentence having a deterrent value, I don't think Pom's sentence will deter anyone from doing what he did.
There are 2 pieces to the Breach/Raid Forums admin puzzle: Operating the site, and participating in it.
In the U.S., it would likely be hard to get prison time for someone running RF/BF/BS. I haven't seen any laws banning it, and Section 230 would be a great first defense.
They went after Omnipotent and Pompompurin with hacking laws and "access devices" laws (I.E. passwords). That's because both ran a "middleman" service, hacked themselves, and/or sold data obtained from hacking.
So if someone was smart and wanted to, they could carefully (as in, follow the advice of a lawyer) run a site like BF and stay out of prison. Very risky, of course ("winning" a criminal case against you can have huge costs, ranging from dollars to reputation, to years of stress until the final verdict). Making money would be the hard part (e.g. if you sell credits so people can download "access devices"=passwords).
Not legal advice to anyone, but something I've thought a fair bit about (I would never run a forum like this, just curious about the law).