On November 13, 2021, the FBI’s public-facing email system was compromised and used to send thousands of messages to addresses drawn from the American Registry for Internet Numbers database. The messages falsely warned recipients of an impending cyberattack and alleged that cybersecurity investigator Vinny Troia had been identified by the U.S. Department of Homeland Security as part of The Dark Overlord hacking group. The campaign was reported as an apparent attempt to defame Troia. Because the messages were transmitted through an FBI-facing system, they appeared legitimate to recipients. The attacker later claimed responsibility under the alias “Pompompurin” in interviews with Krebs on Security and ProPublica, saying the intrusion was done “for fun.”
The FBI said it remediated the software vulnerability that enabled the abuse, instructed recipients to ignore the emails, and stated that the integrity of its computer systems had been confirmed. In March 2023, law enforcement arrested Fitzpatrick on unrelated computer-crime charges in Peekskill, New York. He was subsequently identified in court documents as the operator of the BreachForums cybercrime forum and pleaded guilty to multiple crimes, although the supplied record does not establish that the later plea itself adjudicated the 2021 FBI intrusion. The incident demonstrated how a compromised government communications channel could be weaponized for impersonation, harassment, and reputational harm.
