In recent years, the figure of Phineas Fisher has intrigued many as one of the most renowned hackers, having remained elusive despite their high-profile exploits. A decade after their most notable breach, Phineas continues to be recognized as a remarkable hacktivist who has yet to be apprehended.
This article is part of our exploration into the most significant mysteries in the realm of cybersecurity. We focus on Phineas Fisher, who made headlines for targeting controversial companies creating spyware, including FinFisher and Hacking Team. The latter, an Italian firm, was instrumental in transforming government surveillance tools into a profitable enterprise, paving the way for similar companies like the Israeli NSO Group. The hack on Hacking Team was, in part, responsible for its downfall years later.
Beyond the collective known as Anonymous, which tends to engage in publicity-driven hacks, Phineas Fisher stands out as one of the most recognized names in the hacker community. Their series of audacious hacks is accompanied by numerous unanswered questions.
Who is Phineas Fisher?
Described variously as an anarchist, a cybercriminal, a hacktivist, and a vigilante, Phineas has noted that they adopt different aliases for their hacking endeavors.
The high-profile nature of their hacks has established Phineas as a legend in hacking circles. A notable security researcher expressed a desire to meet them, intrigued by the techniques employed during their attacks. Their escapades have even inspired songs.
Phineas first gained attention in August 2014 when they claimed responsibility for breaching Gamma Group, the creator of the FinFisher spyware, from which their pseudonym is derived. This breach was highlighted through a tongue-in-cheek Twitter account, where they leaked sensitive documents like mobile spyware details and pricing information. While the immediate impact seemed minimal, FinFisher continued operations afterward. Phineas later published an analysis that combined a critique of the company with a leftist political statement, then effectively disappeared.
In 2015, Phineas re-emerged with a significant hack against Hacking Team. They extracted over 400 gigabytes of data, including source code and thousands of internal communications. This leak enabled journalists to uncover various scandals across multiple countries, and years later, the CEO of Hacking Team was compelled to sell the company for a mere euro. For some former staff members, this incident marked the start of the company’s demise.
Phineas also targeted the police union of the Mossos d’Esquadra, Catalonia’s law enforcement, releasing another post-mortem analysis alongside a detailed tutorial video—further aligning with their anti-police stance. They then hacked into Turkey’s ruling party, motivated by solidarity with Rojava, a leftist region in Syria that Turkey has been at odds with.
Their last notable hack was against Cayman National Bank located in the Isle of Man in 2016. This breach showcased a different aspect of Phineas, who shared their belief in making money through illegal means to fund meaningful projects. They indicated a desire to support Rojava, having donated at least $10,000 in Bitcoin to the region.
Three years after this bank hack, Phineas launched the “Hacktivist Bug Bounty Program,” aimed at incentivizing others to expose unethical practices within corporations. When Cayman National Bank acknowledged the breach, they revealed being one of several banks affected. Phineas confirmed that they had been active in targeting financial institutions for years.
Since then, Phineas has become dormant online, with their social media accounts no longer active. Interestingly, a former employee mentioned that FinFisher never took the matter to law enforcement. Investigations by Italian authorities into the Hacking Team breach yielded no concrete leads regarding Phineas’ true identity. However, from personal dialogues, I can confirm that Phineas is reportedly doing well and had reached out to me in recent years.
So who is Phineas Fisher? If we take their statements seriously, they are a hacktivist with anarchistic views, but also share traits typical of cybercriminals. There are questions about whether they could be a false persona created by a government agency, possibly with ties to Russia, known for muddying the waters post-hack. Phineas has denied such affiliations, and their target choices suggest a more complex motivation.
The origins of Phineas remain unclear. They have referenced Spanish-speaking anarchist influences, authored material in Spanish, and follow many left-wing accounts from Latin America on social media. Phineas has stated that their primary language is not English or Spanish, though they have hinted at living in a Spanish-speaking nation. Their statements often weave between truth and misdirection, as they admitted to enjoying the game of misinformation surrounding their identity.
There’s a possibility that the Phineas identity has been shared among various individuals from 2014 to 2019. However, no evidence supports this theory. After a decade of interactions, my intuition suggests that Phineas is likely the genuine hacktivist they claim to be.
