Over the past few decades, a number of mysterious hackers have captured the public imagination, but none quite like Phineas Fisher. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never been caught.
As part of our series on the biggest cybersecurity mysteries of all time, we delve into the enigma of Phineas, the hacktivist who hacked controversial spyware makers FinFisher and Hacking group. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers such as Israel’s NSO Group. Phineas vs. Hacking Team hack ultimately led to the startup’s demise years later.
Aside from Anonymous, an amorphous hodgepodge of hacktivists with a mixed history of mostly gimmicks designed to garner publicity rather than make a real impact, Phineas is perhaps the best-known hacktivist in history. Their story consists of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
Variously called an anarchist, cybercriminal, hacktivist and vigilante, the hacker said they “use a lot of different names” for different hacking campaigns.
The hacks we know were big enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher to buy them a seven-course, three-Michelin-star dinner and hear them explain how they made Hacking Team look like a gym sock,” a well-known security researcher once tweeted. There is even one song for them.
Phineas first appeared in August 2014 when they announced they had hacked Gamma Groupthe makers of the FinFisher spyware — hence the nickname. They publicized the hack through a Twitter account called sassy @GammaGroupPRleaking stolen data including mobile spyware, product manuals and price list. The damage was limited and FinFisher continued. Phineas published an autopsy that became a leftist manifesto and then disappeared.
A year later, they came back with a bang, hacking Hacking Teamanother spyware manufacturer. They took almost everything: more than 400 gigabytes, including source code, tens of thousands of internal emails, confidential contracts and customer lists. The leak allowed journalists to uncover scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’ hack was the beginning of the end.
Phineas continued to hack it union of the Mossos d’Esquadrawhich is the police of Catalonia, publishing an autopsy and a 39 minute video tutorial — consistent with their stated anti-police ideals. Their next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdogan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria against which Turkey was fighting.
Phineas’ last known victim was the Cayman National Bank branch on the Isle of Man, a self-governing island between England and Ireland. The hack hints at a different side of Phineas. “I’ve been looking for illegal ways to make money to free up my time so I can do something useful with it. Once I figured it out, I started scaling it and making more money than I needed and giving the extra money away,” Phineas said in a interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin in Rojava.)
Phineas kept the hack – which happened in 2016 – quiet for three years later before announcing the “Hacktivist Bug Bounty Program”. initiative to reward hacktivists who expose the illegal and unethical activities of companies. When Cayman National Bank confirmed the hack, claimed it “was among several banks that were targeted.” Phineas confirmed that he had hacked several banks over the years.
This was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no online trace. FinFisher never contacted law enforcement, according to a former company employee. The Italian authorities’ investigation into Hacking Team has been completed without finding any evidence showing Phineas’ true identity. What I can say, from my own reporting, is that Phineas is alive and well — they’ve been in contact with me for the past two years.
So who is Phineas Fisher? Taking his claims at face value, he is a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a made-up person controlled by a spy agency—Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy and it is unclear why Moscow would go after all of Phineas’ chosen targets.
Their origins are equally murky. Phineas took down Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed several Latin American leftist Twitter accounts. They told me that their first language is neither English nor Spanish, although they have acknowledged that they live in a Spanish-speaking country. It’s worth taking everything with a grain of salt. “Anything I say that contains clues about my identity is half trolling,” Phineas once told me. “I have a habit of saying misinformation.”
It is also possible that the Phineas persona was broadcast between 2014 and 2019 and used by different people. But there is no proof of this, and after 10 years of discussion, my gut tells me that Phineas really is the hacktivist they claim to be.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
