United States v. Conor Brian Fitzpatrick
A man ran one of the world’s largest data-breach forums under the handle “pompompurin,” after the Sanrio pudding dog. The name is the only Sanrio connection. Everything else is a real federal prosecution.
The record
- Defendant
- Conor Brian Fitzpatrick, a/k/a “pompompurin”
- Court
- U.S. District Court, Eastern District of Virginia (Alexandria)
- Docket No.
- 1:23-cr-00119
- Counts
- Conspiracy to commit access device fraud (18 U.S.C. § 1029(b)(2)); Solicitation for the purpose of offering access devices (18 U.S.C. § 1029(a)(6)); Possession of child pornography (18 U.S.C. § 2252(a)(4)(B))
- Bench
- Senior Judge T.S. Ellis III (plea); Judge Leonie M. Brinkema (sentencing)
- Final sentence
- 36 months (3 years) in prison plus 20 years of supervised release (16 Sep 2025).
- Forfeiture
- Forfeited 100+ domain names, more than a dozen devices, and cryptocurrency proceeds.
The name
The handle comes from Pompompurin, the Sanrio golden retriever in a brown beret, created in 1996. That is the only Sanrio connection. The case is otherwise an ordinary federal prosecution.
What BreachForums was
BreachForums opened in March 2022, within days of authorities seizing its predecessor, RaidForums. It grew past 340,000 members and ran an open market for stolen data: a leaks section, a paid market for verified hacked databases, and an escrow service. Data taken in real breaches, including from the FBI’s InfraGard program and DC Health Link, was trafficked there.
The unusual sentence
Fitzpatrick pleaded guilty to three counts in July 2023. In January 2024 he was given time served, just 17 days, plus 20 years of supervised release. The government appealed it as far too lenient. The Fourth Circuit agreed, vacated the sentence in January 2025, and sent it back. He had by then violated his release terms. In September 2025 he was resentenced to three years in prison.
Procedural history
The FBI portal breach
Using the pompompurin handle, he exploits the FBI’s Law Enforcement Enterprise Portal to send fake emails from a real FBI address. This predates BreachForums.
BreachForums launches
Days after authorities seize RaidForums, he opens BreachForums as its successor. It grows past 340,000 members and runs a market for stolen databases.
InfraGard data sold
Contact data for tens of thousands of members of the FBI’s InfraGard program is auctioned on the forum, with pompompurin named as the escrow guarantor.
Arrest in Peekskill
FBI Special Agent John Longmire arrests Fitzpatrick at his New York home. He is released the next day on a $300,000 bond.
Guilty plea
He pleads guilty to three counts: access-device conspiracy, access-device solicitation, and possession of child pornography.
First sentence
Judge Brinkema imposes time served (17 days) plus 20 years of supervised release. The government appeals it as far too lenient.
Sentence vacated
The Fourth Circuit vacates the sentence as substantively unreasonable and remands. By now he has violated release terms using a VPN, an unmonitored device, and Discord.
Resentenced
Judge Brinkema resentences him to 3 years in prison plus 20 years of supervised release, with forfeiture of domains, devices, and crypto.
This is a real case involving real victims, including a child-exploitation count. It is here because the defendant chose a Sanrio character’s name, not because Sanrio had any part in it. Summarized from public records and reporting; see the sources.
Sources of record