After the takedown of the RaidForums dark web hacker destination last year, BreachForums soon emerged in its place. The suspected administrator and owner of BreachForums, Pompompurin, is now in US Federal custody. During his arrest in connection to operating the hacking platform, 21-year-old Connor Brian Fitzpatrick reportedly admitted to being the owner of the BreachForums cybercrime conclave and claimed the alias “Pompompurin”. FBI Special Agent John Longmire testified that “when I arrested the defendant on March 15, 2023, he stated to me in substance and in part that: a) his name was Conor Brian Fitzpatrick; b) he used the alias ‘pompourin,’ and c) he was the owner and administrator of ‘BreachForums,’ the data breach website referenced in the Complaint.” BreachForums was known to be the largest data leak forum on the market, a digital haven for cybercriminals, hackers, and ransomware gangs looking to sell or buy the caches of data stolen during hacks and breaches. Just last week, the platform was used to post the sensitive personal data of US Congressional members and staff from the DC Health Link breach. A user who goes by the moniker “Baphomet” emerged claiming to be in the process of migrating the platform to new infrastructure. Baphomet also stated that he has enough access to protect BreachForums’ infrastructure and users, has taken steps to restrict access from Pompompurin’s account, and has been constantly monitoring logs to detect any signs of intrusive alterations. The actor named Baphomet is attempting to carry the torch that Pompompurin had once carried after the shutdown of their forebearer, RaidForums. It should be noted that on March 21, 2023, BreachForums was officially shut down, and can no longer be accessed. Baphomet posted a final message on the forum indicating the likely presence of Federal agents within the servers, and thus, the inability to operate in a safe manner. CTIX analysts will continue to monitor the situation and any migrating that occurs due to the shutdown.