Spanish police have arrested three people over a data breach linked to several intrusions at European spy software companies - leading to speculation that the net has closed on the renowned hacker, Phineas Fisher.
A spokesman with Mossos d'Esquadra, Catalonia's regional police, said two men and a woman were arrested in Salamanca and Barcelona on suspicion of breaking into the website of the Mossos union in May, hijacking its Twitter feed and leaking the personal data of more than 5,500 officers.
No more arrests are expected, he added.
The arrests sparked online rumours because the breach had been claimed by Phineas Fisher, a hacker who first won notoriety in 2014 for publishing data from the UK's Gamma Group - responsible at the time for spyware known as FinFisher.
The hacker, or group of hackers, cemented their reputation by claiming responsibility for a breach at Italy's Hacking Team in 2015 which exposed the inner workings of government espionage campaigns. Fisher also appeared as a hand puppet in an unusual interview in 2016.
The Andover-based Gamma Group did not immediately return requests for comment. Neither did FinFisher, the Munich-based company which now sells the eponymous intrusion tool.
Hacking Team spokesman Eric Rabe said he had "no special insight" into the arrests but declined to comment on whether his company was in touch with Spanish authorities.
Toni Castejon, the general secretary of the Catalan police union which was hit, said the language used by the hijacked Twitter account led him to doubt Phineas Fisher had been involved.
The tweets were written "by somebody with perfect knowledge of a very informal kind of Catalan (language) that would have been impossible to achieve through online translation," he said.