Phineas Fisher

"Phineas Fisher" is the pseudonym of a hacktivist, self-described anarchist, and vocal critic of the commercial surveillance industry, active from at least 2014. Fisher is best known for single-handedly breaching two government-surveillance-software vendors — Gamma Group (2014) and Hacking Team (2015) — and publishing enormous troves of each company's internal data as a deliberate act of protest, then publishing detailed technical write-ups explaining both the intrusion methods and the political reasoning behind them. Fisher's real-world identity has never been reliably confirmed by independent reporting, and reporters who have corresponded with the persona, including Motherboard/Vice's Lorenzo Franceschi-Bicchierai, have been unable to establish whether "Phineas Fisher" refers to one person or more than one.

The Gamma Group / FinFisher breach (2014)

In early August 2014, a Reddit user calling themselves "PhineasFisher" posted a link to a roughly 40-gigabyte torrent of internal data taken from Gamma International (Gamma Group), the UK/German-linked firm that made and sold the FinFisher (also called FinSpy) government intrusion-and-surveillance software. The dump, also promoted through a parody Twitter account, @GammaGroupPR, included Gamma's client lists, price lists, portions of FinFisher's source code, internal documentation on the malware's effectiveness, support materials, and training/course materials used to teach government customers how to operate the tool. FinFisher had by that point been sold to more than thirty government agencies and police forces worldwide, and researchers had already linked it to surveillance of journalists, activists, and dissidents in countries including Bahrain and Egypt in the aftermath of the Arab Spring. WikiLeaks later folded portions of the same material into its own "SpyFiles" surveillance-industry document series.

The Hacking Team breach and the "Hack Back!" manifesto (2015)

On July 5, 2015, the official Twitter account of Hacking Team — an Italian company that built and sold intrusion/surveillance software (marketed as the "Remote Control System" or "Da Vinci") to governments and law-enforcement agencies — was hijacked to post: "Since we have nothing to hide, we're publishing all our emails, files, and source code," along with links to more than 400 gigabytes of internal data. The leak exposed Hacking Team's complete internal email archive, its spyware's full source code, invoices, and a client list that included governments and agencies later reported to have poor human-rights records. Phineas Fisher claimed responsibility. In a subsequent "Hack Back!" write-up (a second zine in the same self-published series that began after the Gamma hack, released the following year), Fisher described using a zero-day vulnerability in a SonicWall SSL-VPN appliance, reverse-engineered over roughly two weeks, to gain an initial foothold before moving laterally through Hacking Team's network. The document doubled as a manifesto explaining Fisher's motives, framing the breach as "real" ethical hacking as against paid offensive-security consulting, and arguing that "with just 100 hours of work, one person can undo years of a multimillion dollar company's work. Hacking gives the underdog a chance to fight and win." The guide also gave other would-be hacktivists a beginner-level walkthrough of the techniques used, stating an intent to "inform and inspire you to go out and hack shit."

Public statements and the AKP email leak (2016)

Fisher's public profile grew through 2016. In a July 20, 2016, Vice/Motherboard segment, Fisher gave a first on-camera interview under the condition that the answers, typed over chat, be voiced by a homemade puppet rather than any recognizable person. That same month, Fisher claimed responsibility for breaching the servers of Turkey's ruling Justice and Development Party (AKP), reportedly obtaining hundreds of thousands of internal emails and files; Fisher said the motive was solidarity with the Kurdish movement in the Rojava and Bakur regions. WikiLeaks subsequently published the material as the "AKP emails," but Fisher later said WikiLeaks released the cache before the source had finished exfiltrating data and against the source's explicit request to wait, and that WikiLeaks' publication (which at one point linked to a file exposing the Turkish national identification numbers of roughly 50 million citizens) went out without the source's permission — a dispute Fisher and WikiLeaks have given differing accounts of. Earlier the same year, in a Reddit post dated May 19, 2016, Fisher separately claimed to have hacked an unnamed bank and donated 25 bitcoin (about US$11,000 at the time) to "Rojava Plan," a crowdfunding campaign run by Rojava's economic committee, a hack Fisher would only partly detail. That same intrusion was later tied, in November 2019, to a public leak of roughly 2 terabytes of data — including around 640,000 emails and records on some 1,400 customers — from Cayman National Bank and Trust's Isle of Man operations, which the bank confirmed as a genuine breach.

Funding other hacktivists

In 2019 Fisher announced a self-funded "Hacktivist Bug Hunting Program," offering bounties of up to US$100,000, paid in bitcoin or monero, to other hackers who breached "capitalistic" governments, corporations, or institutions and publicly leaked material of public interest. In 2020, Fisher told Motherboard the fund had made its first payout: US$10,000 to the anonymous hacker behind "MilicoLeaks," a leak of roughly 3,500 emails from Chilean military personnel accounts, published via the leak-hosting site Distributed Denial of Secrets (DDoSecrets). Fisher said the goal was to let "good hackers earn a living in an honest way by revealing material of public interest," rather than working as paid offensive-security contractors for governments and firms Fisher considers the more deserving targets of hacking.

Identity and legacy

Phineas Fisher's real identity remains unconfirmed. Fisher has never been arrested or reliably unmasked, has continued to correspond intermittently and pseudonymously with journalists (chiefly Lorenzo Franceschi-Bicchierai at Motherboard/Vice), and has openly discussed operational-security practices — including routing activity through Tor and funding operations with stolen/laundered bitcoin — credited by researchers with helping the persona evade identification for over a decade. Journalist Joseph Menn's 2019 book on hacktivist history reported a claim, sourced to U.S. government assessments, that Fisher might be connected to Russian intelligence; Fisher denied this directly to Motherboard, and Motherboard separately reported a source describing the U.S. government's own assessment as leaning toward Fisher being a genuine hacktivist rather than a state proxy. It remains publicly unresolved whether "Phineas Fisher" denotes a single individual or, as some researchers have speculated without confirmation, more than one person operating under a shared handle. Beyond the specific breaches, Fisher's write-ups, the "Hack Back!" zines, and the hacktivist bounty program have been widely cited by security researchers and journalists as a turning point in public debate over the commercial spyware/surveillance industry, helping to popularize "hack and leak" as a hacktivist tactic aimed specifically at surveillance-technology vendors.

Timeline

• 2014-08-06A ~40GB data dump from Gamma Group/Gamma International, maker of the FinFisher (FinSpy) spyware, is published via Reddit and the parody Twitter account @GammaGroupPR; Phineas Fisher later claims responsibility.
• 2015-07-05Hacking Team's hijacked Twitter account announces the release of 400+ GB of the Italian spyware maker's internal emails, source code, and client records; Phineas Fisher claims responsibility for the breach.
• 2016-04-17"Hack Back! A DIY Guide" is published, a technical write-up and manifesto detailing the Hacking Team intrusion (via a SonicWall SSL-VPN zero-day) and Fisher's political motives.
• 2016-05-19Fisher claims via Reddit to have hacked an unnamed bank and donated 25 BTC (~US$11,000) to the "Rojava Plan" crowdfunding campaign in Kurdish-controlled northern Syria.
• 2016-07-20Fisher gives a first on-camera interview to Vice/Motherboard, with answers voiced by a puppet to preserve anonymity.
• 2016-07Fisher claims a breach of Turkey's ruling AKP party; hundreds of thousands of emails are later published by WikiLeaks as the "AKP emails," amid a public dispute over the timing and completeness of the release.
• 2019-11-17A ~2TB leak of Cayman National Bank and Trust (Isle of Man) data is publicly disclosed and attributed to Phineas Fisher, later confirmed by the bank as a genuine breach dating back to 2016.
• 2019Fisher announces the self-funded "Hacktivist Bug Hunting Program," offering bounties up to US$100,000 to other hackers for public-interest leaks against governments and corporations.
• 2020Fisher tells Motherboard the bounty program made its first payout, US$10,000, to the hacker behind "MilicoLeaks," a leak of Chilean military emails.