Most data sold on BreachForum was not "hacked" in real-time. It was old combo lists (email:password) used for credential stuffing. MFA (Multi-Factor Authentication) is non-negotiable.

Fitzpatrick was charged with conspiracy to commit access device fraud. The indictment revealed that he possessed over and facilitated the leak of sensitive data from the U.S. House of Representatives’ D.C. Health Link, which exposed the personal data of members of Congress.

As BreachForum's notoriety grew, so did the attention from law enforcement agencies and cybersecurity experts. Several attempts were made to take down the platform, but its administrators and users were skilled at evading detection.