The Hacker Who Humiliated Spyware Makers and Was Never Caught

A Decade of Elusive Hacks and Unanswered Questions

Phineas Fisher is perhaps the most well-known hacktivist in history, with a story made of impressive hacks and endless unanswered questions. Their true identity and motives remain a mystery, with some speculating they may be a fabricated persona or a Russian spy.

Over the last few decades, several mysterious hackers have captured the public's imagination, but none quite like Phineas. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never to have been caught.

Phineas first emerged in August 2014, when they announced they had hacked Gamma Group, the makers of the FinFisher spyware — which is where the nickname comes from. They publicized the hack via a Twitter account cheekily called @GammaGroupPR, leaking stolen data including mobile spyware, product manuals, and a price list.

A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama.

Phineas' hacks were big enough to turn them into a legend among hackers. I would like to meet Phineas Fisher so that I could buy them a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock, a well-known security researcher once wrote on Twitter.

There's even a song about Phineas. Their hacks included the union of the Mossos d'Esquadra, the police force of Catalonia, and the ruling party of Turkey's authoritarian president Recep Tayyip Erdoğan.

Phineas' last known victim was Cayman National Bank's branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of Phineas. I look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away, Phineas said in an interview with activist Freddy Martinez.

Phineas kept the hack — which happened in 2016 — quiet for three years later before announcing the "Hacktivist Bug Bounty Program," an initiative to reward hacktivists who expose companies' illegal and unethical activities.

That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no online trail.

So who is Phineas Fisher? Taking their claims at face value, they're a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a fabricated persona controlled by a spy agency — Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it's unclear why Moscow would go after all of Phineas' chosen targets.

Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed numerous Latin American leftist accounts on Twitter.

It's all worth taking with a grain of salt. Everything I say that contains clues about my identity is half trolling, Phineas once told me.

It's also possible that the Phineas persona was passed around between 2014 and 2019 and used by different individuals. But there is no evidence of that, and after 10 years of conversations, my gut says Phineas truly is the hacktivist they claim to be.

Despite the mystery surrounding Phineas, their impact on the hacking community is undeniable. They have inspired a new generation of hacktivists and have raised awareness about the dangers of spyware and surveillance.