Conor Fitzpatrick, a 20-year-old resident of New York State, was arrested on March 15 and presented Friday to a federal judge in Virginia who served him with his indictment for "computer fraud in organized gang", a count punishable by 5 years in prison.
He is accused of having created in March 2022 the site BreachForums to facilitate exchanges between hackers, with a section dedicated to the sale of stolen personal data or hacking tools, another to tutorials devoted to intrusion methods, etc.
According to court documents, the young man, who used the pseudonym Pompompurin, had opened this platform after the authorities closed a first site of this style, called RaidForums.
"We continue to bring down the main players in the cybercrime ecosystem," Deputy Justice Minister Lisa Monaco said in a statement. Like Raidforums, "BreachForums was the bridge between hackers selling stolen data, and buyers eager to profit from it," she added.
For example, one of its users posted on January 4 the names and contacts of 200 million users stolen from one of the main American social networks. The court documents do not specify which one, but it is Twitter according to several specialized sites.
Another offered in April 2022 the stolen data to 8,000 customers of an American internet services company, including 1,900 credit card numbers.
Beyond the contact, Conor Fitzpatrick is suspected of having served as an intermediary for certain transactions by passing cryptocurrencies and stolen files on his site.
After his arrest, he admitted to creating and running the site and said he earned an average of $1,000 a day, which he reinvested in maintaining BreachForums and buying other domains.
This operation "is a significant disruption to the cybercriminal landscape that will impact for months, before threat actors react and adapt," commented cybersecurity expert Alexander Leslie on Twitter.
© 2023 AFP