The hacker who humiliated spyware makers and was never caught

The Enigma of Phineas Fisher

Phineas Fisher, a mysterious hacker, has been evading capture for over a decade. Their hacks against spyware makers FinFisher and Hacking Team have left a lasting impact on the cybersecurity world. But who is Phineas Fisher, and what motivates them?

Phineas first emerged in August 2014, when they announced they had hacked Gamma Group, the makers of the FinFisher spyware. They publicized the hack via a Twitter account cheekily called @GammaGroupPR, leaking stolen data including mobile spyware, product manuals, and a price list. The damage was limited, and FinFisher carried on. Phineas published a post-mortem that doubled as a leftist manifesto, then vanished. A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama. Years later, Hacking Team's CEO David Vincenzetti was forced to sell his company for one euro.

Phineas went on to hack the union of the Mossos d'Esquadra, which is the police force of Catalonia, publishing a post-mortem and a 39-minute tutorial video — consistent with their stated anti-police ideals. Their next victim was the ruling party of Turkey's authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria that Turkey was fighting against. Phineas' last known victim was Cayman National Bank's branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of Phineas. "I look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away," Phineas said in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)

Phineas kept the hack — which happened in 2016 — quiet for three years later before announcing the "Hacktivist Bug Bounty Program," an initiative to reward hacktivists who expose companies' illegal and unethical activities. When Cayman National Bank confirmed the hack, it claimed it "was amongst a number of banks targeted." Phineas confirmed they had been hacking several banks for years. That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no online trail. FinFisher never contacted law enforcement, according to a former company employee. The Italian authorities' investigation into the Hacking Team hack ended without finding any evidence pointing to Phineas' real identity. What I can say, from my own reporting, is that Phineas is alive and well — they have been in contact with me within the last couple of years.

So who is Phineas Fisher? Taking their claims at face value, they're a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a fabricated persona controlled by a spy agency — Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it's unclear why Moscow would go after all of Phineas' chosen targets. Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed numerous Latin American leftist accounts on Twitter. They told me their first language is neither English nor Spanish, though they have acknowledged living in a Spanish-speaking country. It's all worth taking with a grain of salt. "Everything I say that contains clues about my identity is half trolling," Phineas once told me. "I'm in the habit of saying misinformation." It's also possible that the Phineas persona was passed around between 2014 and 2019 and used by different individuals. But there is no evidence of that, and after 10 years of conversations, my gut says Phineas truly is the hacktivist they claim to be.