Rui Pinto has spent the past decade in one of the strangest positions in European football: prosecuted for hacking, protected by the Portuguese state after handing over what he found, and relied upon by journalists and investigators examining some of the sport’s biggest financial scandals.
Beginning in 2015, the Portuguese computer hacker behind Football Leaks obtained millions of confidential documents exposing contracts, tax arrangements and internal communications across European football. His files helped trigger investigations involving players, clubs and officials across several countries and included the Manchester City emails later published by Der Spiegel, which fed first UEFA’s investigation and then the Premier League’s case against the club.
But Portuguese authorities decided in July to end the special witness-protection arrangements he had received since 2020, after assessing the threat against him as low. Pinto was not informed until 30 September, 83 days later and only shortly before the decision was due to take effect. Portugal’s justice minister has since ordered a review of the situation.
Pinto says that assessment is utterly wrong. He says he has received death threats, fears an assassination attempt and intends to move to an undisclosed location. His lawyers have appealed the decision, while also pointing to an assault in Lisbon earlier this year as evidence that the risk has not disappeared.
The timing inevitably drew attention because Pinto learned of the decision almost immediately after Manchester City was found guilty of serious financial-rule breaches. But the decision itself had been made months earlier, and there is currently no evidence that City, its owners or anyone connected to the club caused Pinto’s protection to be withdrawn.
Nor is Pinto necessarily finished with the Manchester City story. He has indicated that he is prepared to cooperate with UK authorities if his security can be guaranteed, and reporting suggests he may possess additional City-related documents that were not examined during the Premier League investigation.
So what has actually happened to Pinto, how much danger is he in, and what role could he still play in the Manchester City case?
1. What did Football Leaks actually reveal?
Football Leaks was not primarily a Manchester City project. Between 2015 and 2018, Pinto shared 18.6 million documents online and with a consortium of European journalists. The archive contained contracts, emails and other confidential records from clubs, players, agents, lawyers and football organisations.
Some disclosures were about the enormous sums circulating through elite football. The leaks revealed salaries paid to players including Lionel Messi and Neymar and exposed contractual arrangements that clubs and players had previously kept private.
Others had much wider consequences. Documents distributed through Football Leaks helped journalists examine tax arrangements involving leading footballers and brought renewed attention to a lawsuit involving Cristiano Ronaldo, although that case was later dismissed by a US judge. Pinto also supplied material behind the separate Luanda Leaks investigation into the business empire of Isabel dos Santos.
Manchester City became one of Football Leaks’ most consequential subjects. Internal City material obtained by Pinto was passed to Der Spiegel and published from 2018, exposing emails about sponsorship funding and Financial Fair Play. Those disclosures helped trigger UEFA and later Premier League investigations.
Football Leaks therefore did not establish every allegation eventually made against the organisations it exposed. What it did was open a vast private archive that allowed journalists and regulators to start asking questions they previously could not.
2. Did Rui Pinto commit a crime?
Yes.
Pinto has described himself as a whistleblower, but Portuguese courts have also convicted him of crimes connected with the way he obtained and used confidential information.
He was arrested in Budapest in January 2019 and extradited to Portugal. During his first trial, Pinto admitted using illegal methods to obtain millions of documents. In September 2023, a Portuguese court convicted him of nine offences, including unauthorised access to computer systems, interception of correspondence and attempted extortion. He received a four-year suspended prison sentence.
The attempted-extortion conviction involved the Doyen Sports investment fund, which Pinto had approached while in possession of confidential information. That part of the case has always complicated the straightforward description of Pinto as a whistleblower: his conduct included not only acquiring and disclosing information but also an attempt to obtain money.
France also convicted Pinto over hacking emails belonging to Paris Saint-Germain executives, imposing a six-month suspended sentence in 2023.
But another enormous Portuguese prosecution ended very differently. In April 2026, Pinto was acquitted of 241 charges, including allegations that he illegally accessed emails belonging to Benfica, football bodies, lawyers, magistrates and the Portuguese tax authority. The court ruled the charges invalid because they covered conduct for which he had already been prosecuted, rather than finding that no hacking had taken place.
3. Why did Portugal decide to remove his protection?
By 2020, Pinto’s relationship with the Portuguese authorities had changed.
He had spent more than a year in pre-trial detention when he agreed to cooperate with investigators and gave them access to encrypted material containing millions of documents. The man Portugal was prosecuting was suddenly also giving prosecutors information they could use in cases involving other people.
That cooperation led to Pinto entering the protected-witness system. From August 2020, he lived at a confidential residence under arrangements designed to keep his location secret. The protection continued for years while investigators in Portugal and elsewhere worked with material from his archive.
Then, in July 2026, Portugal’s Commission for Special Security Programmes decided the exceptional measures were no longer necessary. Pinto was now considered at “low risk”.
We do not know much more than that. The assessment itself is not public. Portuguese authorities have not explained which threats they considered, why those threats were judged to have diminished, or what had changed since Pinto’s protection was last renewed.
Pinto did not learn about the decision when it was made. He was informed on 30 September, 83 days later, giving him little time to challenge the decision or make alternative arrangements. His lawyers say he was not heard before the commission reached its conclusion.
That delay has brought the decision under additional scrutiny. Justice minister Rita Alarcão Júdice has since ordered a review, meaning the argument is now not merely about whether Pinto remains at risk. It is also about how a six-year protection arrangement was brought to an end.
For now, Portugal’s official position is straightforward: Pinto no longer faces enough danger to justify this level of protection. What the authorities have not publicly shown is why.
4. Is Rui Pinto actually in danger?
There are two competing accounts.
Pinto says yes. Portuguese authorities say the current risk is low.
Pinto says he continues to receive death threats and believes someone may attempt to kill him. What has not been made public are the threats themselves or the intelligence used by Portuguese authorities to decide that they no longer justify special protection.
There is also the attack in April 2026.
Pinto was assaulted in Lisbon and left with a bruised eyebrow. Police were informed, although Pinto did not submit a formal complaint. Nobody has been publicly identified as his attacker and no motive has been established.
The assault cannot currently be attributed to Manchester City, Benfica, Doyen Sports or anybody else exposed by Football Leaks.
But his protected status also involved more than having police on hand. Pinto has been living at a secret address under arrangements intended to prevent people from finding him. Removing that protection changes where he can live, who knows his whereabouts and what security the Portuguese state will provide him.
5. Is any of this connected to Manchester City, and is Pinto still involved?
Pinto was told on 30 September that Portugal intended to end his special protection, almost immediately after the independent commission published its findings against Manchester City. Pinto had also been publicly celebrating the verdict and arguing that the Football Leaks material had finally been vindicated.
But the chronology rules out the simplest explanation. Portugal’s Commission for Special Security Programmes had made its decision in July, almost three months before the City verdict. There is no evidence that Manchester City, its ownership or anyone acting for the club influenced that decision.
But Pinto may still possess information about City that was not reviewed by authorities yet.
He has said through intermediaries that he is prepared to cooperate with UK authorities if they can guarantee his security.
5. Is any of this connected to Manchester City, and is Pinto still involved?
The timing was almost designed to encourage suspicion.
Manchester City had just suffered the biggest defeat of its long-running financial case when Pinto was told that Portugal was ending his protection. He was publicly celebrating the verdict and presenting it as vindication of the Football Leaks material that had first put City’s finances under sustained scrutiny.
But the dates matter more than the coincidence. Portugal’s security commission had made its decision in July, almost three months before the City verdict was published.
There is no evidence that Manchester City, Sheikh Mansour, club executives or anyone acting on their behalf influenced Portugal’s decision.
The same applies to Pinto’s April assault. Nobody has established who attacked him, and there is no evidence connecting it to Manchester City. A chronology can look sinister without proving a connection.
City nevertheless remains part of Pinto’s future because he may still possess material concerning the club.
Pinto has said through intermediaries that he is prepared to cooperate with UK authorities if they guarantee his security. Reporting suggests he may hold further Manchester City documents that were not examined during the Premier League investigation.
Pinto is also not a party to City’s appeal. The Football Leaks material helped start the regulatory process, but the Premier League conducted its own investigation and built its own case before the independent commission.
6. Why is Portugal protecting someone it also prosecuted?
Portugal arrested and prosecuted him because of the methods he used to obtain confidential information. In 2023 he was convicted of nine offences, including unlawful access to computer systems and attempted extortion.
But while that criminal case was developing, Pinto began cooperating with the authorities.
In 2020, he gave investigators access to encrypted drives containing millions of documents. Those files potentially contained evidence relevant to offences committed by people and organisations other than Pinto himself. Portuguese prosecutors and investigators in other European countries subsequently made use of material originating from his archive.
That created two separate legal relationships with the same person.
Portugal could prosecute Pinto for crimes he committed while obtaining information and, at the same time, treat him as a cooperating witness because the information he possessed could help investigate other crimes. One did not cancel out the other.
His entry into witness protection followed from the second role. The state concluded that his cooperation and the information he held exposed him to sufficient risk to justify extraordinary security measures.
The current dispute is therefore not about whether Portugal suddenly decided Pinto was innocent. It did not.
The question is narrower: whether a man who remains a source and potential witness in investigations generated by one of the largest caches of confidential material in European sport still faces enough danger to justify the protections he has received since 2020.