Seventy million documents changed modern football forever. At the center of that data avalanche stands Rui Pinto, a self-taught Portuguese computer hacker whose leaked files triggered Manchester City's unprecedented reckoning with financial rules. While mainstream headlines focus solely on court verdicts and legal penalties, the reality behind Pinto's leaks, arrests, and recent withdrawal of witness protection tells a far more complex story of digital activism, state surveillance, and institutional backlash.
You don't stumble into exposing elite sports corruption by accident. Pinto built Football Leaks in 2015 under the pseudonym John, operating from near Porto with little formal computer science training but an obsessive fixation on financial opacity in professional sports. Before his attention turned toward English football's heavyweight clubs, his leaks exposed confidential contracts, transfer fee manipulations, and offshore accounts involving powerhouse clubs like Benfica and FC Porto. Don't forget to check out our previous post on this related article.
The scope widened dramatically between 2016 and 2018 when Pinto funneled tens of millions of internal documents to the European Investigative Collaborations consortium. Those files exposed how Manchester City bypassed financial rules from 2009 onward through inflated commercial sponsorships and hidden funding streams. When the Premier League formally charged City with 115 counts of financial misconduct, and subsequently found the club guilty on nearly all charges, the foundation of that entire prosecution trace directly back to Pinto's hard drives.
Yet, becoming football's most consequential whistleblower came with brutal personal costs. In January 2019, Hungarian authorities arrested Pinto in Budapest following an international warrant issued by Portugal. Extradited back to his home country, he spent over a year in pre-trial detention, facing severe isolation including periods of solitary confinement. Prosecutors threw a barrage of charges at him, ranging from cybercrime and attempted extortion to illegal data access. To read more about the context here, The Athletic offers an excellent breakdown.
Legal battles stretched across multiple borders. While a French court handed him a six-month suspended sentence for hacking emails belonging to Paris Saint-Germain executives, a Portuguese court sentenced him to four years suspended in 2023. By April 2026, a court acquitted him on hundreds of additional counts after ruling those specific charges invalid. Despite these legal twists, the Portuguese state placed him under formal witness protection starting in August 2020 after he cooperated and handed over access to encrypted hard drives.
That safety net just vanished. Police authorities revoked Pinto's witness protection status, judging his current security risk to be low despite suffering an assault earlier in the year. Authorities advised him to severely restrict his social media activity and maintain distance from family contacts.
Pinto hasn't stayed quiet. Following Manchester City's guilty verdict, he took to social media to call out years of systematic rule-breaking, stating that elite clubs operated with total disrespect for regulations and fans. He has also trained his sights higher, publicly criticizing international leadership figures like FIFA President Gianni Infantino.
The fallout from Football Leaks proves that modern sports governance relies heavily on unauthorized digital disclosures rather than proactive internal auditing. If you want to understand how financial rules are actually enforced in modern athletics, look past official press releases and examine the individual sacrifices made by data activists working outside the law.
:max_bytes(150000):strip_icc()/Gothic-Revival-Lyndhurst-564114549-crop-594407d93df78c537baa4f17.jpg)
