Rui Pinto: The man behind the leaks that exposed Man City
For years, Manchester City fans knew the phrase “Football Leaks” without necessarily knowing the man behind it.
His name is Rui Pinto, a Portuguese computer enthusiast who created an anonymous whistleblowing website that would eventually shake some of the biggest institutions in European football.
Pinto’s name returned to the centre of the Manchester City controversy this week after reports that an independent Premier League commission had found the club guilty of 114 of the 115 financial-rule charges brought against it.
The Premier League has not formally published the ruling and Manchester City says the process remains ongoing, with the club expected to appeal. But the development has once again drawn attention to the man whose leaked documents helped trigger investigations into the club’s finances.
So, who exactly is Rui Pinto?
From Portuguese football fan to Football Leaks
Pinto founded Football Leaks in 2015, initially operating anonymously.
The website became a repository for confidential football documents, including contracts, transfer agreements, correspondence and financial records involving clubs, players, agents and football organisations.
What began as an obscure website soon became one of the biggest document-leak operations football had seen.
Pinto later became known to journalists as “John”, the pseudonym he used while communicating with reporters.
The scale of the material was enormous. More than 70 million documents, amounting to about 3.4 terabytes of data, were obtained by German magazine Der Spiegel and shared with journalists in the European Investigative Collaborations network.
The documents produced investigations into subjects ranging from footballers’ tax arrangements and salaries to secret negotiations between Europe’s biggest clubs.
But one of the most consequential targets was Manchester City.
The Manchester City files
In November 2018, Der Spiegel began publishing reports based on Football Leaks documents alleging that Manchester City had manipulated sponsorship arrangements to get around UEFA’s Financial Fair Play rules.
Among the allegations was that money linked to the club’s owner, Sheikh Mansour’s Abu Dhabi United Group, was being presented as sponsorship revenue from companies including Etihad Airways and Etisalat.
The reports also examined alleged arrangements surrounding payments to former City manager Roberto Mancini.
Manchester City rejected the allegations, describing the leaked material as “out-of-context materials purportedly hacked or stolen” and saying there was an organised attempt to damage the club’s reputation.
But the documents did not remain a media story.
In March 2019, UEFA formally opened an investigation into Manchester City over potential Financial Fair Play breaches, explicitly saying the investigation would focus on allegations that had recently been made public in various media outlets.
A later Court of Arbitration for Sport ruling records that UEFA had written to Manchester City in December 2018 about the Football Leaks publications before formally opening its investigation in March 2019.
That chain is important.
The leaked documents were not themselves a Premier League judgment against Manchester City. They were material published by journalists that helped bring previously hidden allegations into the open and prompted regulatory scrutiny.
UEFA’s case against City
In February 2020, UEFA’s Club Financial Control Body found Manchester City guilty of serious breaches of its Financial Fair Play regulations.
The body said City had overstated sponsorship revenue in its accounts and information submitted to UEFA between 2012 and 2016. It also found that the club had failed to cooperate with the investigation.
UEFA imposed a two-season exclusion from European club competitions and a €30 million fine.
But that was not the end of the matter.
Manchester City appealed to the Court of Arbitration for Sport.
In July 2020, CAS overturned the two-year European competition ban, saying there was insufficient conclusive evidence to uphold all of UEFA’s conclusions and that several allegations were time-barred.
CAS also said the evidence did not establish that the alleged arrangements to disguise owner funding as sponsorship had actually been executed.
However, the court found that City had committed a serious failure to cooperate with UEFA’s investigation and reduced the original €30 million fine to €10 million.
That distinction matters because it shows why the Football Leaks story cannot accurately be reduced to “Pinto exposed City and City was found guilty”.
The documents triggered scrutiny, but different investigations reached different conclusions.
Then came the Premier League investigation
While the UEFA case was unfolding, the Premier League was conducting its own investigation.
The league eventually charged Manchester City in February 2023 following a four-year investigation.
The charges covered alleged financial-rule breaches stretching from the 2009-10 season through 2017-18.
They included allegations that City failed to provide accurate financial information, failed to provide accurate details about player and manager payments, breached UEFA financial regulations and Premier League profitability rules, and failed to cooperate with the league’s investigation.
Thirty-five of the 115 charges concerned the alleged failure to cooperate with the Premier League investigation between December 2018 and February 2023.
The Premier League case therefore became much broader than the original Football Leaks revelations.
But the connection remained.
BBC Sport reported that the allegations against City were thought to relate to the revelations published by Der Spiegel in 2018, while the Premier League investigation itself began in 2019.
And that brings the story back to Pinto.
The man behind “John”
For years, the person feeding the documents to journalists was hidden behind the name “John”.
His identity was eventually revealed as Rui Pinto.
He was not a conventional investigative journalist.
Pinto was a self-taught computer enthusiast and a football fan who had assembled an extraordinary archive of confidential information.
His defenders described him as a whistleblower exposing wrongdoing in an industry where powerful clubs, agents and executives operated behind closed doors.
But authorities saw another side of his activities.
Pinto was arrested in Budapest in January 2019 after Portuguese authorities sought him over allegations including illegal access to computer systems and attempted extortion.
He was extradited to Portugal, where his trial eventually became one of the most closely watched cybercrime cases connected to football.
Whistleblower or hacker?
That question has followed Pinto throughout his legal battles.
Pinto has consistently argued that he was acting in the public interest and rejected the simple description of himself as a hacker.
But in September 2023, a Lisbon court convicted him of nine crimes, including attempted extortion, illegal access to computer systems and violations of correspondence.
He received a four-year prison sentence, suspended, meaning he did not serve the sentence in prison.
The court rejected his argument that freedom of information justified the illegal access involved in obtaining some of the material.
His legal troubles did not end there.
In January 2025, Portugal’s Lisbon Court of Appeal upheld the four-year suspended sentence, although it cancelled compensation that Pinto and another defendant had been ordered to pay to Doyen Sports.
In France, Pinto also received a six-month suspended sentence in November 2023 after admitting to illegally accessing emails belonging to officials at Paris Saint-Germain.
Millions of documents were still hidden
Perhaps the most extraordinary part of the Pinto story is that the Football Leaks archive was much bigger than what journalists initially published.
When Pinto was arrested, investigators seized hard drives containing millions of files. Their encryption made access difficult.
In 2020, Pinto became a protected witness in Portugal after agreeing to give authorities access to the drives and assist with investigations. He has remained under police protection, with his location kept confidential.
French investigators had also been working with Pinto.
In 2018, before his arrest, he provided French prosecutors with a sample containing about 12 million files. French authorities later obtained eight encrypted hard drives seized from him in Hungary.
The cooperation continued.
In 2024, Pinto opened his archive to French and European investigators, allowing authorities to examine tens of millions of previously inaccessible files.
He also said he had handed five hard drives containing millions of documents to French and German authorities, including additional material relating to Manchester City.
Pinto claimed some of the files contained evidence concerning payments he believed had not been disclosed to football authorities.
Those claims should be treated as claims by Pinto rather than independently established facts.
Football’s unlikely whistleblower
Manchester City was not Pinto’s only target.
Football Leaks exposed information involving some of the biggest names and institutions in the sport.
The archive contributed to investigations and reporting concerning players including Lionel Messi, Neymar and Cristiano Ronaldo, while other disclosures examined clubs, agents, tax arrangements and secret plans for a European Super League.
Pinto’s files also eventually became connected to the Luanda Leaks, an investigation into the business empire of Isabel dos Santos, the daughter of former Angolan president José Eduardo dos Santos.
The International Consortium of Investigative Journalists reported that Pinto was the source who provided the Luanda Leaks documents to the organisation behind the investigation.
So the Manchester City story was only one chapter in a much larger archive.
What happened to Pinto?
In April 2026, Pinto was acquitted in a separate Portuguese case in which he had faced 241 charges relating to alleged illegal access to computer systems, correspondence violations and computer damage.
The court declared the prosecution’s indictment invalid and found the case against him unfounded.
But the earlier conviction remains part of his legal history.
That contradiction captures the complicated nature of Pinto’s story.
He has been convicted of crimes connected to obtaining confidential information. He has also cooperated with investigators who wanted access to that same information.
He has been prosecuted as a computer criminal and protected as a witness.
And he has become a symbol, for some, of what can happen when someone outside football’s traditional institutions gains access to the documents hidden inside them.
Why Rui Pinto matters to the Manchester City story
The significance of Pinto is not that he personally decided Manchester City’s fate.
He did not.
The Premier League charges were brought after a lengthy investigation, and the latest reported findings came from an independent commission rather than from Pinto.
Manchester City has continued to deny wrongdoing and is expected to appeal the reported findings.
But without the Football Leaks material, the story might have emerged very differently.
Pinto’s documents gave journalists access to internal emails and financial information that otherwise would have remained behind the walls of one of the world’s richest football clubs.
Those disclosures helped trigger UEFA scrutiny, contributed to years of reporting about City’s finances and were part of the wider chain of events surrounding the Premier League’s investigation.
That is why, almost a decade after the first Football Leaks publications, Rui Pinto’s name remains attached to one of the biggest financial controversies in modern football.
The Portuguese hacker who operated behind the anonymous name “John” may never have lifted a Premier League trophy, sat in a club boardroom or appeared on a touchline.
But from encrypted hard drives and an anonymous website, he helped force some of football’s most powerful institutions to answer questions about what was happening behind the numbers.
And as Manchester City’s legal battle continues, the man who first opened that door remains at the centre of the story.