2021 FBI email hack explained

On November 13, 2021, a hacker named Conor Brian Fitzpatrick, going by his alias "Pompompurin", compromised the FBI's external email system, sending thousands of messages warning of a cyberattack by cybersecurity CEO Vinny Troia who was falsely suggested to have been identified as part of The Dark Overlord hacking group by the United States Department of Homeland Security.[1] [2] [3]

The emails were sent to addresses taken from the American Registry for Internet Numbers database and it was reported that the hacker used the FBI's public-facing email system which made the emails appear legitimate. The campaign was likely done in an attempt to defame Troia. Fitzpatrick later claimed responsibility for the hack.[4]

Responses

FBI

The FBI stated that they remediated the software vulnerability that caused the attack. They told people to ignore the email and "confirmed the integrity" of the FBI's computer systems following the attack.[5]

Pompompurin

The hacker Pompompurin claimed responsibility for the attack in an interview with Krebs on Security.[4] In a later interview with ProPublica Pompompurin later claimed the hack was done for "fun."[6]

Vinny Troia blogged about his belief that it was the work of Canadian hacker Chris Meunier. In an interview with ProPublica, Pompompurin denied being Meunier.[6] [7]

Aftermath

In March 2023 Pompompurin was arrested on unrelated computer crime charges in Peekskill, New York and was identified as a 20 to 21-year-old man named Conor Brian Fitzpatrick. Fitzpatrick was said to have told the arresting officer that he was the creator of BreachForums, which had been created to "fill the void" caused by the seizure of RaidForums a few weeks earlier.[8] [9] He was identified as connected to the 2021 Robinhood Markets data breach and a data breach of Twitter in 2022.[10]

Troia's published report attempted to link hacker Pompompurin to Christopher Meunier (Calgary, Canada), one of the core members of the Dark Overlord hacking group.[11] However, Troia's reporting on The Dark Overlord, Gnostic Players, and Pompompurin state a similar MO in which the group's core members would find less sophisticated hackers and publicly use them as patsies.

In a court document released by The United States Court for the Easter District of Virginia, Fitzpatrick pleaded guilty to a number of crimes including running the cybercrime forum BreachForums.[12] [13] In the court documents, Fitzpatrick stated, "that after RaidForums was seized by law enforcement, he was approached by individuals who thought he would be competent enough to run a similar site. Fitzpatrick stated that he agreed to do so.[14]

Notes and References

  1. News: FBI email system compromised by hackers who sent fake cyberattack alert. en-US. Washington Post. 2022-01-26. 0190-8286.
  2. Web site: Speakman. Kimberlee. FBI Email Server Hacked, Thousands Of Spam Emails Said To Be Sent Out. 2022-01-26. Forbes. en.
  3. News: 2021-11-14. Hackers compromise FBI email system, send thousands of messages. en. Reuters. 2022-01-26.
  4. Web site: Roth. Emma. 2021-11-14. The FBI's email system was hacked to send out fake cybersecurity warnings. 2022-01-26. The Verge. en.
  5. News: Cao. Belinda. FBI Says No Network Data Compromised After Fake Email Incident. Bloomberg.
  6. Web site: Podkul. Cezary. Despite Decades of Hacking Attacks, Companies Leave Vast Amounts of Sensitive Data Unprotected. 2022-01-26. ProPublica. en.
  7. Web site: 2021-11-16. Pompompurin: The hacker behind the FBI email data breach. 2022-01-26. Night Lion Security. en-US.
  8. Web site: FBI arrests BreachForums operator on cybercrime charges .
  9. News: Dark Web 'BreachForums' Operator Charged With Computer Crime .
  10. Web site: Roth . Emma . 2023-03-18 . Feds arrest alleged BreachForums owner linked to FBI hacks . 2023-03-18 . The Verge . en-US.
  11. Web site: POMPOMPURIN: THE HACKER BEHIND THE FBI EMAIL DATA BREACH . Night Lion Security . nightlion.com . 16 August 2023.
  12. Web site: United States v. Fitzpatrick (1:23-cr-00119) . Court Listener . Court Listener . 17 July 2023.
  13. Web site: Hacking Forum "BreachForums" Alleged Owner Pompompurin Arrested and Charged With Cybercrime . CPO Magazine . CPO Magazine . 17 July 2023.
  14. Web site: Franceschi-Bicchierai . Lorenzo . How the FBI caught the BreachForums admin . TechCrunch . 24 March 2023.