Conor Brian Fitzpatrick, a former administrator of the cybercrime platform BreachForums and just 22 years old, will pay nearly $700,000 in an out-of-court settlement of a civil lawsuit related to a healthcare.
See also: HIBP: Data breach affects Hot Topic customers
This is a rare case where an attacker faces immediate financial penalties for facilitating the sale of stolen data through his platform. Fitzpatrick founded BreachForums in March 2022, as a successor to RaidForums, which was shut down by the FBI.
As an administrator, he personally supervised the databases offered for sale and provided escrow services to facilitate transactions.
During his tenure, BreachForums acquired over 300,000 users and facilitated the sale of databases containing over 14 billion individual records.
See also: IntelBroker leaked data from Cisco DevHub portal
Despite repeated takedown operations by authorities, including the most recent in April 2025, variants of BreachForums continue to resurface online, demonstrating how difficult it is to permanently eliminate cybercrime.
Fitzpatrick, known online by the pseudonym “ Pompompurin ,” became involved in the case when sensitive personal data from California-based health insurance company Nonstop Health appeared for sale on BreachForums in January 2023. The data breach exposed tens of thousands of records containing Social Security numbers , dates of birth, addresses and phone numbers of Nonstop Health customers.
In an unprecedented legal move, Nonstop Health lawyers added Fitzpatrick as a third defendant in the class action lawsuit filed in November 2023 after he was arrested by the FBI on criminal charges of conspiracy to commit wire fraud (pursuant to 18 USC § 1029) and possession of child sexual abuse material.
See also: Free: French ISP announces customer data breach
According to KrebsOnSecurity, the settlement marks a significant shift in how cybercriminals may be held accountable through civil proceedings. The $700,000 Fitzpatrick will pay will be added to the $1.6 million Nonstop Health agreed to in January 2025 as part of the class action. Class members can receive reimbursement for out-of-pocket expenses, up to $5,000, for unreimbursed fraud, identity theft and related costs.
Source: cybersecuritynews
