Cyber Threat Actor: Football Leaks

Football Leaks, also known by the alias Rui Pinto, is a threat actor based in Portugal. The actor first came to public attention through the release of large volumes of confidential football‑related data. The group’s activities have centered on obtaining and disseminating internal documents from sports governing bodies, clubs and high‑profile players.

Targeting has been observed primarily against the professional football sector, including European clubs, FIFA and UEFA officials. The actor’s strategic objective appears to be the exposure of alleged financial misconduct, tax avoidance schemes and corrupt practices within the sport. Public reports indicate that the actor used phishing messages aimed at UEFA staff as an initial access vector, although no confirmed intrusion resulted from that specific attempt. In other operations the actor acquired terabyte‑scale datasets containing secret player contracts, tax records and disciplinary information, which were then exfiltrated and provided to media outlets.

Notable operations include the December 2016 leak of approximately 1.9 terabytes (18.6 million documents) to the German publication Der Spiegel, which revealed details about player tax arrangements and club agreements. A second prominent incident occurred in October 2018 when Football Leaks obtained and shared with journalists a set of documents stolen from FIFA’s internal systems following a cyberattack. Earlier disclosures from the actor had already exposed failed drug tests, private nondisclosure agreements such as that involving Cristiano Ronaldo, and other confidential material that prompted regulatory reviews, criminal tax investigations and heightened scrutiny of transfer market practices. These disclosures have been cited as contributing to broader awareness of cybersecurity risks in global sports.