Hacking Team

Background

Hacking Team was an Italian information-technology company headquartered in Milan, founded in 2003 by David Vincenzetti and Valeriano Bedeschi. It grew into one of the best-known vendors of "lawful intercept" and offensive intrusion software, selling to government agencies, police forces, and intelligence services in dozens of countries. The company maintained a small workforce of roughly forty employees and consultants, with additional offices in Annapolis, Maryland, and Singapore, to support an international client base.

Products

The company's flagship product was a suite of intrusion tools marketed as a "Remote Control System" (RCS), sold under the names Da Vinci and later Galileo. Once installed on a target's device, the software could intercept encrypted communications and files, record Skype and other calls, activate cameras and microphones, log keystrokes, track GPS location, and exfiltrate stored data across Windows, macOS, Linux, Android, and iOS. Hacking Team marketed these capabilities to law enforcement and intelligence customers as tools for criminal and counterterrorism investigations.

Scrutiny before the breach

Well before 2015, researchers at the University of Toronto's Citizen Lab had documented Hacking Team spyware being used against journalists and political dissidents rather than only criminal suspects, identifying suspected infections and command-and-control infrastructure linked to governments including Ethiopia, Morocco, and the United Arab Emirates. Citizen Lab and other civil-society groups published open letters and reports pressing the company on its customer vetting practices, but Hacking Team denied selling to governments it said were on relevant blacklists.

The 2015 breach

On 5 July 2015, unknown attackers seized control of Hacking Team's official Twitter account and used it to announce that the company had been compromised, publishing a torrent link to more than 400 gigabytes of internal data. The leaked archive, distributed via BitTorrent and Mega, contained years of internal emails, invoices, contracts, and the complete source code of the company's surveillance products. A hacker using the pseudonym Phineas Fisher subsequently claimed responsibility and later published a detailed technical account of the intrusion, describing how a vulnerability in a SonicWall SSL-VPN appliance used by Hacking Team was reverse-engineered over roughly two weeks to obtain remote root access to the network. The same pseudonymous actor had claimed an earlier, similar breach of the British-German surveillance firm Gamma International (maker of FinFisher) in 2014.

What the leak revealed

Analysis of the leaked documents by journalists and researchers identified roughly seventy Hacking Team customers, including government and law-enforcement bodies in Sudan, Bahrain, Saudi Arabia, Kazakhstan, Ethiopia, Egypt, Mexico, and elsewhere, alongside law-enforcement and defense agencies in established democracies, including in the United States. The leak substantiated years of prior Citizen Lab reporting that some clients had used the company's spyware against journalists and activists rather than solely for criminal investigations. The source-code dump also exposed a previously unknown zero-day vulnerability in Adobe Flash Player (later catalogued as CVE-2015-5119), which was rapidly incorporated into criminal exploit kits within days of the leak becoming public, forcing an emergency patch from Adobe.

Aftermath and legacy

The breach caused significant reputational and regulatory damage. In 2016, Italy's Ministry of Economic Development revoked Hacking Team's global export authorization for its surveillance products, restricting the company to selling within the European Union without case-by-case licensing. The company struggled afterward, was acquired by the investment group InTheCyber in 2019, and ceased operating under the Hacking Team name, with the surveillance business later continuing under successor branding. The incident is widely cited alongside the 2014 Gamma International/FinFisher breach as a turning point that made the internal workings and client rosters of the commercial spyware industry a matter of public record rather than speculation, and it directly informed subsequent journalism, litigation, and policy debate over the export and regulation of intrusion software.

Timeline

• 2003Hacking Team is founded in Milan, Italy, by David Vincenzetti and Valeriano Bedeschi.
• 2014Citizen Lab and other researchers publish findings tying Hacking Team's Remote Control System spyware to surveillance of journalists and activists in countries including Ethiopia, Morocco, and the UAE.
• 2015-07-05Hacking Team's Twitter account is hijacked and used to announce a breach, releasing a link to roughly 400GB of stolen internal emails, contracts, and source code.
• 2015-07The hacker known as Phineas Fisher claims responsibility for the intrusion, which exploited a vulnerability in a SonicWall SSL-VPN device to gain root access to Hacking Team's network.
• 2015-07Journalists and researchers mine the leak to identify roughly seventy government and law-enforcement clients, including Sudan, Bahrain, Saudi Arabia, Kazakhstan, and Ethiopia.
• 2015-07A previously unknown Adobe Flash Player zero-day exposed in the leak (CVE-2015-5119) is quickly adopted by criminal exploit kits, prompting an emergency Adobe patch.
• 2016Italy's Ministry of Economic Development revokes Hacking Team's global export license, restricting sales outside the European Union.
• 2019Hacking Team is acquired by the investment group InTheCyber.
• 2020The company ceases operating under the Hacking Team name.