Football Leaks

Profile narrative

Football Leaks, also known by the individual name Rui Pinto, is a threat actor associated with the release of large volumes of confidential football‑related documents. The actor is based in Portugal, as indicated in the available context, and operates under the alias Football Leaks when publishing leaked material to media outlets. No additional aliases or organizational affiliations are mentioned in the provided sources.

The actor’s targeting has focused on the professional football sector, specifically targeting international governing bodies such as FIFA and UEFA, as well as European clubs and high‑profile players. The strategic objective evident from the disclosed incidents is to expose alleged financial misconduct, tax avoidance schemes, and corruption within the sport, which has subsequently prompted regulatory reforms, criminal tax evasion prosecutions, and heightened scrutiny of transfer market practices. These objectives are explicitly described in the incident summaries rather than inferred.

Regarding tactics, techniques, and procedures, the only referenced initial access vector is a phishing operation aimed at UEFA officials, although no confirmed intrusion resulted from that effort. The actor’s primary tooling style involves the acquisition and exfiltration of large data sets, exemplified by the transfer of 1.9 terabytes comprising 18.6 million documents to a German publication. No specific malware families, exploit kits, or custom tooling are mentioned in the source material.

Attribution publicly points to Rui Pinto as the individual behind the Football Leaks moniker, with no evidence presented linking the actor to a state sponsor or a criminal consortium. Notable campaigns include the December 2016 leak of confidential football documents to Der Spiegel and the October 2018 cyberattack on FIFA’s internal systems, after which stolen documents were shared with media outlets for imminent publication. These operations illustrate the actor’s pattern of obtaining sensitive sports data and facilitating its release to journalists.

Incidents

Attributed incidents are available to members.