The hacker who humiliated spyware makers and was never caught

Over the past few decades, many mysterious hackers have captured the public’s imagination, but none quite like Phineas Fisher. A decade after his most famous hack, Phineas remains, by most accounts, the most prolific and public hacker to never be caught.

As part of our series on the biggest cybersecurity mysteries of all time, we’re delving into the mystery of Phineas, the hacktivist who hacked into controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers like Israel’s NSO Group. Phineas’ hack against Hacking Team eventually led to the startup’s demise years later.

Aside from Anonymous, an amorphous mix of hacktivists with a mixed record of mostly sensational hacks designed to garner publicity rather than make a real impact, Phineas is perhaps the most famous hacktivist in history. Their story is made up of impressive breakthroughs and countless unanswered questions.

Who is Phineas Fisher?

Hackers are called various names such as anarchist, cybercriminal, hacktivist, and vigilante, and he said they “use a lot of different names” for different hacking adventures.

The hacks we know of were significant enough to turn Phineas into a legend among hackers. A well-known security researcher once wrote on Twitter: “I would love to meet Phineas Fisher so I could buy a three-Michelin-starred seven-course dinner somewhere and listen to them explain how they turned Hacking Team upside down like a gym sock.” There’s even a song about them.

Phineas first appeared in August 2014, when they announced that they had hacked Gamma Group, the maker of the FinFisher spyware – hence the nickname. They posted the hack via a cheekily named Twitter account @GammaGroupPRand leakage of stolen data including mobile spyware, product manuals and price lists. The damage was limited, and Operation FinFisher continued. Phineas published a posthumous statement that was a leftist manifesto, then disappeared.

A year later, they came back with a vengeance, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to uncover scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’s breakthrough was the beginning of the end.

Phineas went on to infiltrate the Mossos d’Esquadra, Catalonia’s police force, and published a post-mortem video and a 39-minute educational video – consistent with their stated anti-police principles. Their next victim was the ruling party of authoritarian Turkish President Recep Tayyip Erdogan, a hacker motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria against which Turkey had been fighting.

Phineas’s last known victim was a branch of the Cayman National Bank on the Isle of Man, a self-governing island between England and Ireland. The breakout hinted at a different side of Phineas. “I look for illegal ways to make money in order to free up my time so I can do something useful with it,” Phineas said in an interview with activist Freddy Martinez. “Once I discovered that, I started expanding it and making more money than I needed and donating the extra.” (Phineas donated at least $10,000 in Bitcoin to Rojava.)

Phineas kept the hack – which occurred in 2016 – quiet for three years afterward before announcing the Hacktivist Bug Bounty Programme, an initiative to reward hacktivists who expose illegal and unethical corporate activities. When Cayman National Bank confirmed the hack, it claimed it “was among a number of banks targeted.” Phineas confirmed that they had hacked into many banks for years.

This was their last public appearance. Their Twitter and Reddit accounts were deleted long ago, leaving no trace online. FinFisher never contacted law enforcement, according to a former employee at the company. The Italian authorities’ investigation into the Hacking Team hack ended without finding any evidence pointing to Phineas’s real identity. What I can say, from my own reports, is that Phineas is alive and well, and they have been in contact with me for the past two years.

So who is Phineas Fisher? If we take their claims seriously, they are hacktivists with anarchist ideals, but they are also cybercriminals. Could they instead be a fabricated figure controlled by a spy agency — Russia, for example, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it is not clear why Moscow would pursue all of Phineas’ chosen targets.

Their origins are equally mysterious. Phineas name-dropped Spanish-speaking anarchists, wrote the hacker team posthumously in Spanish, and followed several Latin American leftist accounts on Twitter. They told me that their first language was neither English nor Spanish, even though they acknowledged living in a Spanish-speaking country. It’s all worth taking with a grain of salt. “Everything I say that contains clues about my identity is half-trolling,” Phineas once told me. “I’m used to telling misinformation.”

It is also possible that the Phineas figure was circulated between 2014 and 2019 and used by different individuals. But there’s no evidence of that, and after 10 years of conversations, my gut says Phineas is actually the hacker they claim he is.