In 2014, the unidentified hacktivist known as Phineas Fisher breached Gamma International, the company associated with FinFisher surveillance malware, and released roughly 40 gigabytes of data. The dump reportedly included client lists, prices, source code, technical documentation, support materials, and information about the malware’s effectiveness. Fisher later claimed responsibility in a 2015 HackBack! guide that explained how the intrusion was conducted and encouraged others to target surveillance companies. WikiLeaks republished the material in its SpyFiles archive, making the commercial spyware ecosystem more visible to researchers and the public.
In 2015, Fisher also claimed to have breached Italian spyware vendor Hacking Team, alleging that access came through a previously undisclosed vulnerability in a SonicWall SSL-VPN device. The leak exposed company emails and internal files; WikiLeaks subsequently published the correspondence, while SonicWall patched the vulnerability before public disclosure. Fisher’s attacks highlighted how vendors selling intrusive hacking tools to governments could themselves fail basic security controls, while also creating new privacy risks by releasing customer and operational data. Fisher’s identity remains unknown, and allegations that the hacker acted for Russia were disputed by Fisher and were not established in the supplied source.
