The hacker who humiliated the spymasters and never got caught

Over the past few decades, several mysterious hackers have captured the public imagination, but none quite like Phineas Fisher. Ten years after their most famous heist, Phineas is, by most accounts, the biggest and most public burglar ever to be caught.

As part of our series on the biggest cybersecurity mysteries of all time, we delve into the mystery of Phineas, the hacktivist who hacked the controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the first to turn government spying into a viable global business, paving the way for spyware makers like Israel’s NSO Group. Phineas’ hacking against the Hacking Squad eventually led to the demise of the startup years ago.

Aside from Anonymous, an amorphous group of hacktivists with a mixed record of hack stunts designed to rally the public rather than have real impact, Phineas is perhaps the best-known hacktivist in history. Their story is made up of impressive hacks and endless unanswered questions.

Who is Phineas Fisher?

Variously called anarchist, hacker, hacktivist, and vigilante, the hacker said they “use a lot of different names” for different hacking escapades.

The hacks we know were big enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher to buy them a seven, three Michelin-star meal somewhere and listen to them explain how they turned The Hacking Team inside out like a gym sock,” the well-known security researcher once tweeted. There is even a song about them.

Phineas made its debut in August 2014, when it announced it had hacked Gamma Group, makers of the FinFisher spyware – hence the nickname. They announced this hack through a Twitter account with a slick name @GammaGroupPRleaked stolen data including mobile spyware, product manuals, and price lists. The damage was limited, and FinFisher continued. Phineas published a post-mortem that doubled as a leftist manifesto, then disappeared.

A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took almost everything: over 400 gigabytes of source code, tens of thousands of internal emails, confidential contracts, and customer lists. Leaks allowed journalists to expose scandals in Ecuador, Mexico and Panama. Years later, Travel Group CEO David Vincenzetti was forced to sell his company for one euro. For some ex-employees, Phineas’ robbery was the beginning of the end.

Phineas went on to hack the Mossos d’Esquadra union, which is Catalonia’s police force, publishing an autopsy report and a 39-minute instructional video – echoing their anti-police views. Their next target was the ruling party of authoritarian Turkish president Recep Tayyip Erdoğan, a rebel fueled by alliances with Rojava, an autonomous region in northern and eastern Syria that Turkey was fighting.

Phineas’ last known victim was a Cayman National Bank branch on the Isle of Man, a self-governing island between England and Ireland. Hacking brought out a different side of Phineas. “I look for illegal ways to make money to free up my time to do something useful with it. Once I found that, I started to raise and make more money than I need and give extra,” said Phineas in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)

Phineas kept the hack – which happened in 2016 – quiet three years later before announcing the “Hacktivist Bug Bounty Program,” an initiative to reward real hackers who expose illegal and wrongful activities of companies. When Cayman National Bank confirmed the hack, it said it was “among many banks that were targeted.” Phineas confirmed that they had been robbing several banks for years.

It was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no trace of the Internet. FinFisher has never contacted law enforcement, according to a former company employee. The investigation by the Italian authorities into the robbery of the robbery team has ended without finding any evidence that points to the true identity of Phineas. All I can say, from my personal reporting, is that Phineas is alive and well – they have been in contact with me for the past few years.

So who is Phineas Fisher? If they take their claims literally, they are hacktivists with anarchist views, but they are also hackers. Could it be a fictitious person controlled by a spy agency – Russia, say, which has a history of naming hacktivists to drown in the water after their hacks? Phineas has denied being a Russian spy, and it’s unclear why Moscow would go after all of Phineas’ chosen targets.

Their origins are equally obscure. Phineas dropped the names of Spanish-speaking anarchists, wrote a Hacking Team post-mortem in Spanish, and followed several Latin American leftist accounts on Twitter. They told me that their first language is neither English nor Spanish, although they admitted that they live in a Spanish-speaking country. Everything is worth taking with a grain of salt. “Everything I say that contains clues about who I am backfires a little bit,” Phineas once told me. “I have a habit of telling lies.”

It is also possible that the Phineas persona was passed between 2014 and 2019 and used by different people. But there is no evidence of that, and after 10 years of interviews, my gut says that Phineas really is the ranger they say he is.