Tech
The hacker who humiliated spyware makers and was never caught
Over the last few decades, several mysterious hackers have captured the public’s imagination, but none quite like Phineas Fisher. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never to have been caught.
As part of our series on the biggest cybersecurity mysteries of all time, we’re delving into the enigma of Phineas, the hacktivist who hacked controversial spyware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers such as the Israeli NSO Group. Phineas’ hack against Hacking Team eventually led to the startup’s demise years later.
Apart from Anonymous, an amorphous amalgam of hacktivists with a mixed track record of mostly stunt hacks designed to gather publicity rather than have real impact, Phineas is perhaps the most well-known hacktivist in history. Their story is made of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
Variously called an anarchist, a cybercriminal, a hacktivist, and a vigilante, the hacker has said they “use a lot of different names” for different hacking escapades.
The hacks we know about were big enough to turn Phineas into a legend among hackers. “I would like to meet Phineas Fisher so that I could buy them a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,” a well-known security researcher once wrote on Twitter. There’s even a song about them.
Phineas first emerged in August 2014, when they announced they had hacked Gamma Group, the makers of the FinFisher spyware — which is where the nickname comes from. They publicized the hack via a Twitter account cheekily called @GammaGroupPR, leaking stolen data including mobile spyware, product manuals, and a price list. The damage was limited, and FinFisher carried on. Phineas published a post-mortem that doubled as a leftist manifesto, then vanished.
A year later, they came back with a bang, hacking Hacking Team, another spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama. Years later, Hacking Team’s CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’ hack was the beginning of the end.
Phineas went on to hack the union of the Mossos d’Esquadra, which is the police force of Catalonia, publishing a post-mortem and a 39-minute tutorial video — consistent with their stated anti-police ideals. Their next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria that Turkey was fighting against.
Phineas’ last known victim was Cayman National Bank’s branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of Phineas. “I look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away,” Phineas said in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)
Phineas kept the hack — which happened in 2016 — quiet for three years later before announcing the “Hacktivist Bug Bounty Program,” an initiative to reward hacktivists who expose companies’ illegal and unethical activities. When Cayman National Bank confirmed the hack, it claimed it “was amongst a number of banks targeted.” Phineas confirmed they had been hacking several banks for years.
That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no online trail. FinFisher never contacted law enforcement, according to a former company employee. The Italian authorities’ investigation into the Hacking Team hack ended without finding any evidence pointing to Phineas’ real identity. What I can say, from my own reporting, is that Phineas is alive and well — they have been in contact with me within the last couple of years.
So who is Phineas Fisher? Taking their claims at face value, they’re a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a fabricated persona controlled by a spy agency — Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it’s unclear why Moscow would go after all of Phineas’ chosen targets.
Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed numerous Latin American leftist accounts on Twitter. They told me their first language is neither English nor Spanish, though they have acknowledged living in a Spanish-speaking country. It’s all worth taking with a grain of salt. “Everything I say that contains clues about my identity is half trolling,” Phineas once told me. “I’m in the habit of saying misinformation.”
It’s also possible that the Phineas persona was passed around between 2014 and 2019 and used by different individuals. But there is no evidence of that, and after 10 years of conversations, my gut says Phineas truly is the hacktivist they claim to be.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
One fallen power line exposed a growing AI data center problem. Here’s how to fix it.
A power line went down outside of Washington, DC, this week. Normally, the grid would only need a few seconds to recover from such an event. But this one took more than 10 minutes because more than 3 gigawatts of data centers stopped drawing power nearly simultaneously.
The event caused voltage across the PJM grid to spike from Northern Virginia to Chicago, according to data collected by Ting Labs, a startup that runs an IoT sensor network out of people’s electrical sockets.
The event didn’t cause a blackout, but it did cause lights across the region to flicker. The incident demonstrated the effect that data centers can have on the grid — an outcome that experts believe will become more frequent.
Northern Virginia, which is in PJM’s territory, is home to the highest concentration of data centers in the world.
“It’s the canary in the coal mine,” Ricardo de Azevedo, CTO at ON.Energy, told TechCrunch. These sorts of events involving large loads like data centers are “happening more and more,” he added.
The event echoes one that happened two years ago, also on PJM’s grid, and it could foreshadow larger events if data centers aren’t built to more elegantly handle disruptions to power supplies. The PJM Interconnection manages grids from New Jersey to Illinois and serves 67 million customers, making it the largest grid operator in the United States.
When the power line went down this week, it triggered data centers to switch to backup power, and about 3.1 gigawatts of load vanished in about 30 seconds, according to PJM data. The grid appeared to recover somewhat, but a short time later additional loads dropped off. At its peak, PJM’s grid had an extra 3.49 gigawatts of electricity on it. It took another 11 minutes before it stabilized. The disconnected data centers represented around 3% of total demand on PJM at the time, according to Reuters.
A few percent may not sound like much, but the electrical grid needs to operate in a state of near-perfect balance, with supply and demand closely matched. If they don’t, voltages can sag or spike. The grid and devices connected to it can tolerate small fluctuations, but if those fluctuations grow too large, they’ll trigger failsafes within the grid or within individual facilities, causing them to disconnect.
When data centers in Northern Virginia sensed the fluctuation caused by the failed power line, they switched to backup power, which removed their load from the grid. As more data centers made the switch, they removed greater amounts of load from the grid. What started as a relatively small drop in supply became an even larger drop in demand, sending supply surging and causing light bulbs to flicker.
Most data centers make decisions in a split second, and those that disconnected this week appear to be no different. When the voltage dip reached them, they all decided to disconnect within a few seconds of each other, Ali Zain Banatwala, senior market models specialist at the Independent Electricity System Operator, told TechCrunch.
“We need to figure a way for these loads that are located next to each other to sequentially either disconnect or reconnect,” he said. A more orderly process would allow grid operators to develop more robust procedures in advance.
Alternatively, data centers could be built to absorb disruptions and not turn their backs to them. One startup, ON.Energy, has been working on a product to help data centers — and the grid — ride through events like the one that occurred this week.
The company has developed an uninterruptible power supply for an entire data center campus, covering not just servers but also chillers and other equipment. The company essentially hides the data center behind a bank of batteries connected to sophisticated power conversion equipment. All the grid “sees” is one consistent, well-behaved load rather than the peaks and valleys from each individual part of the data center. ON.Energy’s system allows data centers to ramp computing workloads up and down, including AI training, without bothering the grid.
Perhaps more important, it also means that data centers can absorb power fluctuations from the grid. Rather than disconnecting from the grid, ON.Energy’s system can use any extra power to charge its batteries, and if the flow dips, the system can dispatch power to servers. Plus, it can follow the grid’s lead within milliseconds, preventing sags or surges like the ones that caused this week’s problem for PJM.
ON.Energy is currently installing a total of 3 gigawatts worth of its systems at four different data center campuses, de Azevedo said.
Grid managers have also woken up to the problem.
ERCOT, for example, is going to require large loads like data centers to “ride through” disruptions, de Azevedo said.
The clock is ticking, though. The mass disconnection this week was twice as large as a similar event in 2024, when 60 data centers simultaneously disconnected, pulling 1.5 gigawatts of load from the grid. Back then, data centers accounted for about 6% of PJM’s load, according to Synapse Energy Economics. By 2040, they are expected to make up 24%. If the problem isn’t addressed soon, things could get a lot worse.
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Librarians are hosting viral ‘Avoiding AI’ workshops for people who are fed up with Big Tech
“Everybody’s on their phone at my program!” joked Charlie Bailey, a librarian in South Philadelphia. He’s just asked his audience to pull out their phones so that he can walk them through the steps of disabling Apple Intelligence and Gemini.
Bailey stands at the front of a library classroom that’s outfitted for children – the focal point is the vibrant rug he’s standing on, which reminds us that M is for “moon” and Z is for “zebra.” But the 20-odd adults in the room aren’t here to learn about the alphabet. They’re at a workshop called Avoiding AI, which, in this context does not stand for “apple” and “igloo.”
“I was inspired by the feeling of people’s frustration with AI tools being kind of forced onto them, and feeling like AI tools we didn’t ask for are suddenly everywhere in our lives,” Bailey told TechCrunch.
Bailey starts the hour-long workshop with an overview of how AI chatbots and other consumer AI tools work, explaining why people might want to use these products, and why they might opt to abstain. Then, he walks through all of the most popular tech platforms and devices, showing step-by-step instructions on the projector to guide people through turning off specific features.
“As a librarian, I think it’s important to see this as advancing digital literacy and helping people reclaim their autonomy over whether they want to use AI tools,” Bailey said. “It’s important, especially when it can be so difficult not to use them, and when the design seems to force adoption.”
Bailey got the idea for the Avoiding AI workshop from Hannah Cyrus, a librarian in Maine. He was one of dozens of librarians from around the world who contacted Cyrus after she published a journal article about developing her own workshop.
“This has never happened before with anything I’ve worked on,” Cyrus told TechCrunch. “Nobody has ever been emailing me like, ‘Can you give me your Intro to Computers slides?’”
At the Bangor Public Library, patrons turn to Cyrus when they need help with anything involving technology.
“More and more, I was getting questions about, ‘How do I turn this [AI] stuff off? Why is it trying to write my emails for me? Why is it trying to summarize my one-sentence email that I can easily read?’” Cyrus said. “I just decided that with so much media hype out there about AI products, it would be a good opportunity to teach people about the basics of what is happening when you’re using this technology, and then getting into how to turn it off if you don’t want to use it.”
Usually, Cyrus’ classes like Intro to Computers get about a dozen attendees. But so many people expressed interest in her first Avoiding AI workshop that she had to cut off registration at 30 people, open a waitlist, and share the workshop on Zoom. Including the livestream, about 70 people attended each of Cyrus’ first two workshops.
When Bailey followed Cyrus’ lead to host a workshop in Philadelphia, the reception was similarly unprecedented. The library’s Instagram post about the “Avoiding AI” event got over 2,000 likes and 220 shares, whereas most of the library’s posts don’t get more than a few dozen likes. He scheduled a second program because the first got too many registrations.
“As an information professional, it feels good to see people skeptical of AI,” Bailey said. “It felt really good to see how many people share this feeling.”
There’s a sense of camaraderie among the room of strangers during the workshop. When Bailey invites attendees to share their own tips, one person explains that when you append “&udm=14” to a Google Search, it will hide AI results. Bailey writes the string of characters down on a whiteboard next to the log-in credentials for the teen Wi-Fi server.
“You have to go through all the trouble to buy a home in today’s world, and two years from now, there could be a data center next to your house,” one workshop attendee named Johnny says.
“I keep getting AI shoved down my throat at work, and every time I see it, I think about the environment,” another attendee named Gabrielle adds. But she’s also not writing off AI as a technology altogether. “I’m not against AI in terms of medical breakthroughs.”
AI naysayers know that this technology is far broader than just chatbots and deepfake apps. Cyrus mentioned how useful optical character recognition is for scanning old documents at the library. But for her and the people who go to her workshops, the anti-AI movement isn’t about rejecting technology altogether so much as it is about advocating for more control, agency, and freedom in how people use technology.
“I think the forced adoption of AI on people’s devices might be the straw that’s breaking the camel’s back in some ways,” she said. “The awareness has been growing for a long time that these products and these companies that make them have an outsized influence over us, and that we’re not really using these products in the way that we would like to.”
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Tech
Kalshi demands Netflix take down trailer for ‘Prediction Games’ documentary
Prediction market Kalshi sent Netflix a cease-and-desist letter on Friday demanding that the streaming service take down the trailer for an upcoming documentary. In the letter, Kalshi claimed the trailer is “defamatory” and contains “both fabricated documents and false and misleading statements.”
“Instadocs: The Prediction Games” is a documentary about the rise of prediction markets. According to Netflix, the film — part of the streamer’s “Instadoc” series of fast-turnaround documentaries — features interviews with both Polymarket CEO Shayne Coplan and Kalshi CEO Tarek Mansour.
The trailer, however, focuses on a recent party in Las Vegas, where men who have “made millions of dollars on prediction markets, probably eight figures, just over the course of the World Cup” have gathered to watch the World Cup final. One of the guests declares, “I like betting on Kalshi,” while another shows off an apparent $5,000 bet on their phone.
However, Kalshi is currently banned from operating in Nevada due to a court order. In its cease-and-desist letter, Kalshi said the bet shown on the phone is actually a screenshot of a bet made on May 16, 2025 — long before the ban. But the company argued that in the trailer, Netflix “misled its millions of customers into believing this individual was able to successfully trade sport event contracts in Nevada on July 19, 2026.”
In its letter, Kalshi also said that it recently spoke to a Netflix employee who “agreed not to feature the receipt in the documentary when it is released” on Sunday, July 26.
“However — despite Kalshi demonstrating to this employee that the claims in the video were demonstrably false — Netflix inexplicably refused to remove the receipt from the trailer currently circulating on the homepage of the Netflix app,” the company said.
Netflix doesn’t dispute that the screenshot is of a bet from 2025, but a spokesperson told The Hollywood Reporter that none of the documentary footage was fabricated.
“The footage was filmed at the Winible World Cup Watch Weekend in Las Vegas on July 17, 2026,” the spokesperson said. “The featured trader with the trade on Spain showed us a screenshot of his bet, that was made in May 2025 prior to any Nevada court order. Any specific trades or bets referenced during that weekend are between the individual and the app in which they placed the trades.”
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.
Jenny Shin inches closer to first LPGA Tour win in 10 years
Charlize Theron's Forgotten R-Rated Thriller Gets Second Life On Streaming
