The US Federal Bureau of Investigation (FBI) has arrested the alleged operator of BreachForums, the hacking site where 10,000 customer records from the Optus data breach were posted.

Authorities arrested Conor Brian Fitzpatrick, who goes by the alias ‘Pompompurin’, last week on charges related to the sale of data for use in fraud.

In an affidavit republished by Bleeping Computer, FBI Special Agent John Longmire said Fitzpatrick admitted “he was the owner and administrator of ‘BreachForums’” and that he went by the name ‘Pompompurin’, upon arrest at his home in New York.

Fitzpatrick posted a US$300,000 bond and was released late last week with restrictions on his movement and communications.

The Pompompurin account famously exposed a vulnerability in an FBI domain that allowed him to spam thousands of emails from an FBI-affiliated address back in 2021.

He was also responsible for scraping data about Twitter users from an API vulnerability, and for stealing data from 7 million customers of US stock trading company Robinhood.

Pompompurin was a user of RaidForums before the FBI shut it down last year and took it upon himself to keep a version of that criminal hacking forum and stolen data marketplace alive.

During Fitzpatrick’s operation of BreachForums, it gained a surge of Australian popularity after the hacker who accessed millions of Optus customer records used the forum to demand US$1 million from the telco before leaking a sample to prove the data was legitimate.

A Sydney teenager downloaded that data and used it to try and scam 93 people out of $2,000 each. He was caught by the Australian Federal Police, plead guilty to fraud offences, and was subsequently sentenced to 100 hours of community service and an 18-month community correction order.

BreachForums appears to still be running despite Fitzpatrick’s arrest.