2021 FBI email hack
{{Short description|Email hacking in 2021}}
On November 13, 2021, a hacker named Conor Brian Fitzpatrick, going by his alias "Pompompurin", compromised the FBI's external email system, sending thousands of messages warning of a cyberattack by cybersecurity author and investigator Vinny Troia who was falsely suggested to have been identified as part of The Dark Overlord hacking group by the United States Department of Homeland Security.{{Cite news|title=FBI email system compromised by hackers who sent fake cyberattack alert|language=en-US|newspaper=Washington Post|url=https://www.washingtonpost.com/nation/2021/11/14/fbi-hack-email-cyberattack/|access-date=2022-01-26|issn=0190-8286}}{{Cite web|last=Speakman|first=Kimberlee|title=FBI Email Server Hacked, Thousands Of Spam Emails Said To Be Sent Out|url=https://www.forbes.com/sites/kimberleespeakman/2021/11/13/fbi-email-server-hacked-thousands-of-spam-emails-said-to-be-sent-out/|access-date=2022-01-26|website=Forbes|language=en}}{{Cite news|date=2021-11-14|title=Hackers compromise FBI email system, send thousands of messages|language=en|work=Reuters|url=https://www.reuters.com/world/us/hackers-compromise-fbis-external-email-system-bloomberg-news-2021-11-13/|access-date=2022-01-26}}
The emails were sent to addresses taken from the American Registry for Internet Numbers database and it was reported that the hacker used the FBI's public-facing email system which made the emails appear legitimate. The campaign was likely done in an attempt to defame Troia. Fitzpatrick later claimed responsibility for the hack.{{Cite web|last=Roth|first=Emma|date=2021-11-14|title=The FBI's email system was hacked to send out fake cybersecurity warnings|url=https://www.theverge.com/2021/11/14/22781341/fbi-email-system-hacked-fake-cybersecurity-warnings|access-date=2022-01-26|website=The Verge|language=en}}
Responses
= FBI =
The FBI stated that they remediated the software vulnerability that caused the attack. They told people to ignore the email and "confirmed the integrity" of the FBI's computer systems following the attack.{{Cite news|last=Cao|first=Belinda|date=|title=FBI Says No Network Data Compromised After Fake Email Incident|work=Bloomberg|url=https://www.bloomberg.com/news/articles/2021-11-14/fbi-says-no-network-data-compromised-after-fake-email-incident|access-date=}}
= Pompompurin =
The hacker Pompompurin claimed responsibility for the attack in an interview with Krebs on Security. In a later interview with ProPublica Pompompurin later claimed the hack was done for "fun."{{Cite web|last=Podkul|first=Cezary|title=Despite Decades of Hacking Attacks, Companies Leave Vast Amounts of Sensitive Data Unprotected|url=https://www.propublica.org/article/identity-theft-surged-during-the-pandemic-heres-where-a-lot-of-the-stolen-data-came-from?token=pIt-Qx8lrKMcPei_lM3rFDQpHXkkcxXQ|access-date=2022-01-26|website=ProPublica|language=en}}
Aftermath
In March 2023 Pompompurin was arrested on unrelated computer crime charges in Peekskill, New York and was identified as a 20 to 21-year-old man named Conor Brian Fitzpatrick. Fitzpatrick was said to have told the arresting officer that he was the creator of BreachForums, which had been created to "fill the void" caused by the seizure of RaidForums a few weeks earlier.{{cite web | url=https://thebrunswicknews.com/news/business/fbi-arrests-breachforums-operator-on-cybercrime-charges/article_b25d9af4-d31b-54e2-8ae4-9ed13a4892cc.html | title=FBI arrests BreachForums operator on cybercrime charges }}{{Cite news |title=Dark Web 'BreachForums' Operator Charged With Computer Crime |url=https://www.bloomberg.com/news/articles/2023-03-17/dark-web-breachforums-operator-charged-with-computer-crime#xj4y7vzkg}} He was identified as connected to the 2021 Robinhood Markets data breach and a data breach of Twitter in 2022.{{Cite web |last=Roth |first=Emma |date=2023-03-18 |title=Feds arrest alleged BreachForums owner linked to FBI hacks |url=https://www.theverge.com/2023/3/18/23646476/feds-arrest-alleged-hacking-forum-owner-breachforums-pompompurin |access-date=2023-03-18 |website=The Verge |language=en-US}}
In a court document released by The United States Court for the Eastern District of Virginia, Fitzpatrick pleaded guilty to a number of crimes including running the cybercrime forum BreachForums.{{cite web |title=United States v. Fitzpatrick (1:23-cr-00119) |url=https://www.courtlistener.com/docket/67597382/united-states-v-fitzpatrick/ |website=Court Listener |publisher=Court Listener |access-date=17 July 2023}}{{cite web |title=Hacking Forum "BreachForums" Alleged Owner Pompompurin Arrested and Charged With Cybercrime |url=https://www.cpomagazine.com/cyber-security/hacking-forum-breachforums-alleged-owner-pompompurin-arrested-and-charged-with-cybercrime/ |website=CPO Magazine |publisher=CPO Magazine |access-date=17 July 2023}} In the court documents, Fitzpatrick stated, "that after RaidForums was seized by law enforcement, he was approached by individuals who thought he would be competent enough to run a similar site. Fitzpatrick stated that he agreed to do so.{{cite web |last1=Franceschi-Bicchierai |first1=Lorenzo |title=How the FBI caught the BreachForums admin |url=https://techcrunch.com/2023/03/24/how-the-fbi-caught-the-breachforums-admin/ |website=TechCrunch |date=24 March 2023}}