The founder and operator of BreachForums, Conor Brian Fitzpatrick, received a sentence of time served and 20 years of supervised release for his involvement in running the cyber crime website.

Fitzpatrick, who used the online nickname “pompompurin,” was captured in March 2023 in New York and faced charges of conspiracy to commit access device fraud and possession of child pornography. He was later freed on a $300,000 bond, and in July 2023, he admitted to the charges.

BreachForums was a major online platform for trading stolen data since March 2022. Before it was shut down a year later, the website had over 340,000 members.

The website offered various types of stolen data, such as bank account information, Social Security numbers, personally identifying information (PII), hacking tools, breached databases, and account login information for hacked online accounts with service providers and merchants.

BreachForums also promoted services for accessing victim systems without authorization. The website affected millions of U.S. citizens and hundreds of U.S. and foreign companies, organizations, and government agencies.

Fitzpatrick also ran a “Leaks Market,” where he acted as a trusted intermediary (i.e., escrow) between users on the website who wanted to exchange hacked or stolen data, tools, and other illegal material.

“Fitzpatrick also allegedly operated an ‘Official’ databases section where BreachForums directly sold access to verified hacked databases through a “credits” system managed by the platform,” the U.S. Department of Justice stated.

Court records obtained by DataBreaches.net indicate that Fitzpatrick’s mental health may have influenced his sentence. Prosecutors suggested a 15-year prison term for the defendant a day before sentencing.

The 21-year-old is expected to spend the first two years of supervised release on house arrest with a GPS location tracker and receive mental health treatment. He has also been ordered to avoid using the internet for the first year and register with the state sex offender registration agency in any state where he lives.

The amount of restitution Fitzpatrick has to pay for victims’ losses has not been decided yet. Earlier this month, Fitzpatrick was imprisoned for breaking the terms of his pre-sentencing release by using an unmonitored computer and a virtual private network (VPN).

However, the illegal service did not stop after law enforcement seized the domains in March 2023. In June 2023, BreachForums was revived by the notorious ShinyHunters group, who were previously active on the Raid Forums, the takedown of which led to the launch of BreachForums.

A Russian citizen, Alexander Ermakov, who goes by various online aliases, has been sanctioned by the governments of Australia, the U.K., and the U.S. for his involvement in a major cyberattack on Medibank, an Australian health insurance provider, in 2022.

Ermakov is accused of hacking into the Medibank network and stealing and leaking the personal and medical data of about 9.7 million current and former customers of the company. The data breach was carried out by the REvil ransomware gang, which has since ceased operations.

The sanctions prohibit anyone from dealing with Ermakov’s assets, including cryptocurrency wallets or ransomware payments, and impose a travel ban on him. Anyone who violates the sanctions could face up to 10 years in prison.

The U.K. government said the sanctions are part of their efforts to combat the malicious cyber activities of Russia, which threaten the security and prosperity of the U.K. and its allies.

The U.S. Treasury Department also criticized Russia for harboring and supporting cyber criminals who launch ransomware attacks against the U.S. and other countries, targeting their businesses and critical infrastructure. The Treasury Department urged Russia to take action to stop cyber criminals from operating freely in its territory.

“Russian cyber actors continue to launch disruptive ransomware attacks against the United States and allied countries, targeting our businesses, including critical infrastructure, to steal sensitive data,” said Under Secretary of the Treasury Brian E. Nelson.

“This action demonstrates that the United States stands with our partners to disrupt ransomware actors who victimize the backbone of our economies and critical infrastructure,” the Treasury Department said.

A cyberattack on Reddit in February, in which the threat actors claimed to have stolen 80GB of data from the company, was carried out by the BlackCat (ALPHV) ransomware gang.

Reddit revealed on February 9 that a phishing attack on an employee on February 5 resulted in the hacking of its systems.

The threat actors were able to access Reddit’s systems through a phishing attack, stealing internal documents, source code, employee data, and limited information about the company’s advertisers.

In a post, Reddit CTO Christopher Slowe, aka KeyserSosa, explained, “After successfully obtaining the credentials of a single employee, the attacker gained access to some internal documents, code, as well as some internal dashboards and business systems.”

“We don’t show any signs of a breach in our primary production systems,” which are the parts of our stack that run Reddit and store most of our data.

However, Reddit stated that neither user passwords nor credit card information nor production systems were compromised.

Reddit did not provide many details about the phishing attack, but they did say that it was similar to a Riot Games phishing attack that allowed hackers to gain access to systems and steal source code for League of Legends (LoL), Teamfight Tactics (TFT), and the Packman legacy anti-cheat platform of the company.

The threat actors demanded $10 million from Riot during the attack to prevent the leak of the stolen data. However, the threat actors attempted to sell the data on a hacking forum for $1 million if a ransom was not paid.

The ALPHV ransomware operation, more commonly referred to as BlackCat, now asserts that it was behind the February 5th cyberattack on Reddit. This information was first discovered by Dominic Alvieri and shared with BleepingComputer.

The threat actors claim to have stolen 80 GB of compressed data from the company during the attack and now plan to leak the data in a “Reddit Files” post on the gang’s data leak site.

The perpetrators of the threat claim that they attempted to get in touch with Reddit twice, on April 13 and June 16, and demanded $4.5 million in exchange for the deletion of the data.
“In my first email, I told them that I would wait for their IPO.” However, this seems like the ideal occasion! We are exceptionally sure that Reddit won’t pay any cash for their information,” compromised the ransomware activity.

“However, I am overjoyed to learn that the public will be able to read about all of the statistics they track about their users as well as all of the fascinating confidential data we collected. Did you know that they also censor users in secret? together with items from their GitHub!”

BleepingComputer has been able to confirm that this is the same attack that was disclosed by Reddit in February, despite the fact that Reddit declined to make any comments regarding BlackCat’s post.

Despite the fact that BlackCat is a group responsible for ransomware, they did not encrypt any devices during this attack.

A similar attack on Western Digital in March 2023, which resulted in a significant outage of the company’s My Cloud cloud service, is thought to have been carried out by the same hacking group.

The Western Digital attack’s perpetrators initially denied having a name, but screenshots of the stolen data were leaked on the ALPHV data leak website, where the perpetrators taunted the company about the attack.

In May, Western Digital sent notifications about data breaches to customers of its online stores, advising them that their data had been stolen during the attack.