Hacking Team hacked – bad news for firm that helps governments spy on their citizens

Hacking TeamHacking Team, an Italian company which specialises in helping governments and intelligence agencies spy on their citizens, has found itself hacked – and its internal emails and documents published on the net.

The first public clue that Hacking Team had a serious problem came when the firm’s Twitter account was compromised, and its name changed to “Hacked Team”.

An out-of-character tweet posted on the hacked account contained a link to what the attackers claimed was a 400 GB dump of the company’s internal files, source code and communications:

Hacking Team Tweet

Sign up to our free newsletter.
Security news, advice, and tips.

Since we have nothing to hide, we’re publishing all our e-mails, files and source code [LINK]

No one has yet claimed responsibility for the hack, but the company’s primary surveillance tool (known as Da Vinci), helped it earn a spot on an “Enemies of the Internet” list compiled by Reporters without Borders.

In short, this Milan-based company has no shortage of online enemies around the world.

Hacked Hacking Team

Hacked Team
Developing ineffective, easy-to-pwn offensive technology to compromise the operations of the worldwide law enforcement and intelligence communities.

Internal documents stolen by the hackers reveals the location of the company’s customers, including Australia, Azerbaijan, Bahrain, Chile, Colombia, Cyprus, Czech Republic, Ecuador, Egypt, Ethiopia, Germany, Honduras, Hungary, Italy, Kazakhstan, Luxembourg, Malaysia, Mexico, Mongolia, Morocco, Nigeria, Oman, Panama, Poland, Russia, Saudi Arabia, Singapore, South Korea, Spain, Sudan, Switzerland, Thailand, UAE, United States, Uzbekistan, and Vietnam.

Furthermore, observers who have seen documents released by the hackers say that it includes passwords used by both Hacking Team staff and its customers. Sadly the passwords appear to prove that even those you would hope understand the importance of good password security still make very bad choices:







A YouTube video acts as an advertisement for Hacking Team’s services – although it’s questionable just how many intelligence agencies would want to use the services the firm now it has been so seriously breached.

Hacking Team Commercial

The Hacking Team website, which does not appear to have been breached, currently says it is hiring new staff. However, you have to wonder if there will be much of a company left to join following the repercussions of this hack.

Hacking Team website

Further reading:

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.

6 comments on “Hacking Team hacked – bad news for firm that helps governments spy on their citizens”

  1. Bob

    Timely news – just as we've seen that the top VPNs have failed in security tests:


  2. Jim

    Website's down now … http://www.hackingteam.it/
    Well at least for me …

  3. John H

    GOOD! Do these people really think that the community won't fight back particularly after what Mr Snowden revealed.
    Now they & their clients know its not a one-way street. Incidentally look at those clients none of them are a byword for democracy are they!

  4. David L

    The problem remains,because the vast majority of those being servaled will never know it. But I would hope that all the major AV venders are busily writing new definitions to cover this discovery. I for one,can't wait to read all the reports when they come out. Security junky that I am (-:

  5. Coyote

    "…reveals the location of the company's customers, including…"

    That list is absolutely pathetic. Never mind the hypocrisy it shows, the list shows just how petty governments can be; they have to pay a company to break the law because why? Inability? Too lazy? Want to add to the list of things they hide? Other reasons? All of the above? Ah, that is it.

    But good. This company was asking for trouble based on what they do. Also, since it is supposedly legal for them to do what they do (…) then one would like to believe (…) that those who compromised them would also not be breaking the law by doing so.

    As for the password list. What to say? There isn't much to say on the passwords themselves. What there is to say is questioning why they have them plaintext …

  6. Anonymous

    It will be interesting to watch the revelations that continue to follow from this.

What do you think? Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.