Over the past few decades, several mysterious hackers have captured the public’s imagination, but none like Phineas Fisher. A decade after his most famous hack, Phineas remains, by most accounts, the most prolific and public hacker ever caught.

As part of our series on the biggest cybersecurity mysteries of all time, we delve into the enigma of Phineas, the hacktivist who hacked controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was one of the first to turn government spyware into a viable global business, paving the way for spyware makers like Israeli group NSO. Phineas’ attack on Hacking Team ultimately led to the startup’s demise years later.

Aside from Anonymous, an amorphous amalgam of hacktivists with a mixed track record of tricks mostly designed to gain publicity rather than have any real impact, Phineas is perhaps the best-known hacktivist in history. His story is made up of impressive tricks and endless unanswered questions.

Who is Phineas Fisher?

Variously called an anarchist, cybercriminal, hacktivist and vigilante, the hacker has said he “uses a lot of different names” for different hacking adventures.

The hacks we know about were big enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher so I can treat them to a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,” a well-known security researcher once wrote on Twitter. There’s even a song about them.

Phineas first emerged in August 2014, when they announced that they had hacked Gamma Group, the creators of the FinFisher spyware, where the nickname comes from. They posted the trick through a Twitter account cheekily named @GammaGroupPRleaking stolen data, including mobile spyware, product manuals and a price list. The damage was limited and FinFisher moved on. Phineas published an autopsy that served as a leftist manifesto and then disappeared.

A year later, they came back with a vengeance and hacked Hacking Team, another spyware maker. They took virtually everything: more than 400 gigabytes, including source code, tens of thousands of internal emails, confidential contracts and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, the Phineas hack was the beginning of the end.

Phineas then hacked into the Mossos d’Esquadra union, which is Catalonia’s police force, publishing an autopsy and a 39-minute tutorial video, consistent with his stated anti-police ideals. Their next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a left-wing autonomous region in northern and eastern Syria that Turkey was fighting.

Phineas’ last known victim was the Cayman National Bank branch on the Isle of Man, a self-governing island between England and Ireland. The trick hinted at a different side of Phineas. “I look for illegal ways to earn money to free up my time and be able to do something useful with it. Once I was clear about it, I started expanding it and earning more money than I need and giving away the extra,” Phineas said in an interview with activist Freddy Martínez. (Phineas donated at least $10,000 worth of Bitcoin to Rojava.)

Phineas kept the attack, which occurred in 2016, quiet for three years before announcing the “Hacktivist Bug Bounty Program,” an initiative to reward hacktivists who expose companies’ illegal and unethical activities. When Cayman National Bank confirmed the attack, it stated that it “was among several banks attacked.” Phineas confirmed that they had been hacking into various banks for years.

That was his last public appearance. His Twitter and Reddit accounts were deleted long ago, leaving no trace online. FinFisher never contacted police, according to a former company employee. The Italian authorities’ investigation into the Hacking Team hack ended without finding any evidence pointing to Phineas’ true identity. What I can say, based on my own reports, is that Phineas is alive and well; They have been in contact with me in recent years.

So who is Phineas Fisher? Taking their claims at face value, they are hacktivists with anarchist ideals, but also cybercriminals. Could they instead be a fabricated person controlled by a spy agency (Russia, for example, which has a history of inventing hacktivists to muddy the waters after its own attacks)? Phineas has denied being a Russian spy and it is unclear why Moscow would go after all of Phineas’ chosen targets.

Its origins are equally murky. Phineas named Spanish-speaking anarchists, wrote the Hacking Team’s autopsy in Spanish, and followed numerous Latin American leftist accounts on Twitter. They told me that their first language is neither English nor Spanish, although they have acknowledged that they live in a Spanish-speaking country. It’s worth taking everything with a grain of salt. “Everything I say that contains clues to my identity is half-trolling,” Phineas once told me. “I have a habit of saying wrong information.”

It’s also possible that Phineas’ persona passed between 2014 and 2019 and was used by different people. But there’s no evidence of that, and after 10 years of conversations, my gut says that Phineas is really the hacktivist he claims to be.