On the morning of July 5, 2015, Hacking Team woke up to find 400 gigabytes of their internal data on the internet. The dump had been announced from their own Twitter account, which someone had compromised during the night. The data included internal emails, financial records, source code for their Remote Control System malware, and - most damaging - a complete list of their government clients and the details of what those clients were using the software to do.
Hacking Team was an Italian company that sold surveillance software to governments. Their product, variously called Da Vinci, Galileo, and Remote Control System, was a commercial version of the same capability that state intelligence agencies developed internally. The difference was that Hacking Team sold it - to anyone who could pay and who could obtain approval from Italian export authorities. The 2015 breach exposed who those buyers were and provided the security research community with the complete technical capabilities of commercial surveillance software.
The Remote Control System
Hacking Team's Remote Control System was marketed as "offensive technology for the interception of data from any device, in any location, any encryption." The pitch was accurate. RCS could intercept encrypted communications by operating on the device before encryption and after decryption. It could record audio and video, extract files, log keystrokes, and access contacts. It supported Windows, macOS, Linux, iOS, Android, BlackBerry, and Windows Phone.
Operationally, RCS was managed through a distributed command-and-control infrastructure that allowed clients to access their targets' devices through a dashboard. The infrastructure was designed to resist tracing: RCS used a layered architecture with proxy servers in multiple countries that obscured the true origin of control traffic. This helped clients conducting sensitive operations maintain deniability if devices were forensically analyzed.
The Client List
The leaked data included invoices and correspondence identifying Hacking Team's government clients. The list included agencies from dozens of countries. Several were immediately controversial. Sudan was under international sanctions at the time of its contract. Ethiopia had used surveillance tools against journalists, including journalists living in diaspora in the United States and Europe. Russia and Azerbaijan were on the list. Egypt, Morocco, and Saudi Arabia - all countries with documented histories of surveilling political opponents and journalists.
Hacking Team had maintained a public position that it did not sell to repressive governments and had controls to prevent human rights abuses. The leaked emails showed internal discussions that were substantially more ambiguous. Employees raised concerns about specific clients. Management made commercial decisions that overrode those concerns. The internal debate showed a company aware of the ethical dimensions of its business but prioritizing revenue.
Some clients were less surprising: FBI, DEA, and several other US law enforcement agencies were among the buyers. These were the legitimate law enforcement uses that Hacking Team's marketing emphasized. The problem was that the technology that legitimate law enforcement agencies used domestically under judicial oversight was the same technology being sold to Sudan.
The Zero-Days
Among the most technically significant disclosures were multiple zero-day vulnerabilities for Windows, iOS, Flash, and other platforms. Hacking Team maintained a portfolio of unpatched vulnerabilities as components of their attack capability. When you're selling a product that can compromise any device, you need working exploits to do the compromising. Some of these were developed internally; others were purchased from external researchers.
The leaked Flash vulnerabilities were patched by Adobe within days of the dump, as was a Windows privilege escalation vulnerability. But for the weeks between when the zero-days were deployed in operations and when they were patched post-disclosure, every device running the affected software was vulnerable to exploitation by anyone who read the leaked source code.
This was the first large-scale public exposure of a commercial surveillance vendor's zero-day portfolio. The revelation that companies like Hacking Team routinely held and used unpatched vulnerabilities in commercial software - vulnerabilities that could be used by anyone if disclosed - added evidence to the argument that surveillance software vendors represented a systemic risk to the security of the internet.
The Attacker
The hacker responsible for the breach identified themselves as Phineas Fisher (also known as Phineas Phisher). In interviews and published technical write-ups, Phineas Fisher described the breach as motivated by political opposition to the surveillance industry and claimed to be acting alone. The technical write-up they eventually published described a sophisticated, patient intrusion: months of reconnaissance, exploitation of a network device at the network perimeter, lateral movement through internal systems, and exfiltration of the complete data set before triggering the public disclosure.
Phineas Fisher's identity was never confirmed by law enforcement. Spanish authorities arrested a Spanish citizen in 2021 in connection with a subsequent hack of a police union, but whether this individual was responsible for the Hacking Team breach was not established. Phineas Fisher continued to communicate publicly through interviews and Tor-accessible publications for several years after the breach.
The technical write-up Phineas Fisher published is one of the most detailed first-person hacker narratives ever made public. It describes the reconnaissance methodology, the specific vulnerabilities exploited, the internal navigation through Hacking Team's network, and the exfiltration process - written as a tutorial intended to show that corporate surveillance companies could be held accountable through their own methods being turned against them.
The Industry's Response
Hacking Team did not survive the breach in any meaningful operational sense. The source code disclosure made their primary product essentially worthless - security researchers could now detect RCS infections, build signatures for the malware, and develop forensic techniques to identify it. Several countries that had been clients publicly distanced themselves. The CEO gave a disastrous interview in which he claimed no government clients were using the software for illegal purposes, while the leaked emails were being read by journalists globally.
The company attempted to rebuild under new ownership and a new name. Some former employees went to other surveillance vendors. The capabilities that Hacking Team had developed - and the market they had established for commercial surveillance software - did not disappear with the company. They dispersed.
The surveillance technology industry that exists today, with NSO Group as its most prominent member, is in many ways the successor to Hacking Team. The client base is similar. The technical approaches are more sophisticated. The corporate structure is more carefully managed to deflect accountability. But the fundamental business model - developing exploitation capabilities for sale to governments - continues, and the fundamental tension between legitimate law enforcement use and authoritarian abuse continues.
What It Changed
The Hacking Team breach established several things that informed subsequent debates about the surveillance industry. First, that commercial surveillance vendors do sell to governments with records of human rights abuses. Second, that those vendors maintain portfolios of unpatched zero-day vulnerabilities - software vulnerabilities that affect everyone - as commercial assets. Third, that the distinction between "lawful intercept" and "espionage against dissidents" is primarily a marketing distinction that depends entirely on how clients use the tools they purchase.
It also demonstrated, for the first time at scale, that private companies in the surveillance technology space were themselves attackable - and that attacking them could expose their clients and capabilities in ways that had significant accountability effects. The Phineas Fisher breach directly damaged Hacking Team's business. The Conti leaks in 2022 directly damaged Conti's operations. The pattern of hackers turning surveillance and criminal capabilities against the organizations that deploy them appears periodically in the ecosystem.
Whether this represents an accountability mechanism for actors that operate in legal grey zones, or whether it is itself an unaccountable form of vigilantism that causes unpredictable collateral damage, is a question the security community continues to debate without resolution.