How International Insight's investigative capabilities tracked down the hacker behind one of the biggest data leaks in sporting history — before the authorities caught up three years later.
From 2015, a source calling themselves "Football Leaks" began releasing a flood of confidential documents from some of the world's most powerful football clubs, agents and governing bodies. Tax arrangements, transfer deals, player contracts and financial structures that had never been intended for public view were suddenly exposed.
The scale was extraordinary. The source was unknown. And the question being asked across the sport — and in courtrooms and boardrooms across Europe — was the same: who was doing this, and where were they?
"What could an investigative journalist uncover? In this case — everything."
International Insight was engaged to identify the individual behind Football Leaks. The investigation combined traditional journalistic source development with detailed open-source analysis and financial intelligence — the same methodology we apply to all our cases.
The hacker made contact through encrypted channels. But contact, however careful, leaves traces. Through patient analysis of digital footprints, financial records and social connections, the investigation began to narrow.
The trail led to Rui Pedro Gonçalves Pinto — born 20 October 1988 in Vila Nova de Gaia, Portugal. A history student who had not graduated. A fan of trance music and Porto football club. And, it emerged, someone with a history of serious financial irregularities.
On 19 September 2013, €34,658.67 was transferred from a bank in the Cayman Islands into Pinto's account — which had previously contained just €31.67.
On 11 October, a further €227,332.80 followed from the same source.
Investigations showed that someone using an IP address at Porto University had accessed a bank's backup email server in Jersey — obtaining usernames and passwords giving administrator access to the bank's systems.
By the time of the investigation, Pinto had moved to Budapest, registered as a student at ELTE University on a valid student visa. He had deleted his social media and stopped attending classes.
But while Pinto was careful, his friends were not.
They tagged him in photographs. One posted a video of him serving behind the bar at a pub in Budapest. Another showed him at an escape room. A network of images, locations and connections was assembled — placing him precisely.
"He attempted to delete his social media. His new friends weren't so cautious — helpfully tagging him on nights out."
International Insight provided the intelligence on Pinto's location to the relevant authorities in 2016. Three years later, on 16 January 2019, Rui Pinto was arrested — at the same address we had identified.
He was held on a European Arrest Warrant and extradited to Portugal in March 2019. Portugal's Public Prosecutor's Office formally accused him of 147 crimes: 75 charges of illegal access to data, 70 of violation of correspondence, one of computer sabotage and one of attempted extortion.
The question that surrounded Football Leaks from the beginning was whether Pinto was a brave whistleblower exposing wrongdoing in football, or a criminal who hacked, stole and attempted to extort.
The evidence pointed clearly in one direction. He was not an insider who witnessed wrongdoing. He broke into systems, stole data, transferred funds into his own account and sought payment for the return of stolen documents. As The Guardian noted at the time — that is blackmail.
The investigative skills that identified and located Rui Pinto are the same skills International Insight brings to every mandate. Human intelligence. Persistent analysis. The ability to find people who do not want to be found.
International Insight applies the same investigative rigour to every case — from asset tracing to litigation support to corporate fraud.
Make a confidential enquiry