Football Leaks founder Rui Pinto fears for his life after Portugal strips whistleblower of state protection

Rui Pinto, the founder of Football Leaks whose phishing attack on Manchester City’s internal systems in January 2017 set in motion one of football’s biggest financial scandals, has been stripped of his Portuguese state protection — leaving him, according to his lawyers, in a “critical” situation.

Portuguese authorities confirmed on Wednesday that Pinto will lose the safe house and witness-protection privileges he has held since 2020, with the arrangement ending on 10 October. Officials have deemed the 37-year-old to be low risk and have advised him to stay off social media, avoid crowded places, and refrain from contacting his family.

His legal team moved quickly to challenge the decision. In a statement on Friday, they described the withdrawal of protection as “shameful actions” amounting to “an act of state terrorism”, and pointed to a physical assault on Pinto in Lisbon last April as evidence that the threat against him is far from theoretical.

“His situation is now critical. The threats against him are not merely theoretical; he was assaulted in Lisbon last April,” the statement reads. “Abruptly deprived of his protected housing and plunged into a state of extreme precariousness, Rui Pinto would be more vulnerable now than at any time since 2020.”

The timing is striking. Pinto had been publicly celebrating on social media in the days following the Premier League commission’s guilty verdict against Manchester City, writing that “years and years of cheating, lying and manipulation will finally have consequences.” His lawyers argue that the verdict itself illustrates why the dangers he faces remain live — many of the legal proceedings stemming from his leaks are still ongoing, and the individuals implicated command considerable resources.

Pinto’s story is not straightforward. While he presents himself as a whistleblower who sacrificed his freedom to expose wrongdoing in elite football, he also carries a criminal conviction. In September 2023, a Portuguese court handed him a suspended four-year sentence after finding him guilty of attempted extortion, illegal access to data, and breach of correspondence — charges related to his hacking of Doyen Sports, an investment fund and player-management agency, from which he leaked a large volume of internal documents.

Pinto had been living in Budapest under the alias “John” before being unmasked and extradited to Portugal in March 2019. His Football Leaks material was taken up by a consortium of European investigative journalists and formed the basis of major reporting on financial irregularities across the continent’s top clubs — most consequentially, the allegations against Manchester City that eventually led to the Premier League’s independent commission proceedings.

City have consistently denied wrongdoing and have confirmed they will appeal the commission’s verdict. Pinto, meanwhile, faces an uncertain and, his lawyers insist, dangerous next chapter.