How fake UEFA email opened Manchester City’s saga

A seemingly routine email sent to a Manchester City official in January 2017 turned into a major cybersecurity breach, exposing thousands of the club’s emails and documents and setting off a saga that would stretch for almost a decade.

The email, sent on a Wednesday morning, appeared to have come from an employee of UEFA, European football’s governing body. It contained a link to what was presented as a financial compliance report.

The City official clicked on the download link.

But the email was fake.

It was part of a phishing operation carried out by Portuguese hacker and activist Rui Pinto, who used the breach to gain access to Manchester City’s computer systems and retrieve thousands of internal emails and documents.

The stolen material later became central to revelations about the club and its financial affairs, keeping the fallout from the 2017 cyberattack alive long after the initial breach.

Almost 10 years after Pinto sent that first email, the Premier League announced this week that an independent panel had found Manchester City guilty of all but one of the charges brought against the club, according to The Athletic.

The case has therefore come full circle from a deceptive email landing in an official’s inbox to a major disciplinary finding involving one of English football’s biggest clubs.

Pinto’s method was straightforward but effective: impersonate a trusted UEFA contact, provide a seemingly legitimate financial document and rely on the recipient clicking a link.

That single click gave him access to City’s systems, allowing him to obtain a vast cache of internal correspondence and documents.

The breach and the information subsequently made public became part of the wider controversy surrounding Manchester City, whose long-running Premier League case has now reached a significant stage with the independent panel’s findings.