It was a seemingly innocuous email, sent on a Wednesday morning in January 2017, that started everything.
Arriving in the inbox of a senior official at Manchester City, it appeared to have been sent by an employee from European footballβs governing body, UEFA, and contained a link to a financial compliance report.
The City official clicked the download button. That was all it took.
It was not a genuine email from UEFA but a successful phishing attempt by Portuguese hacker and activist Rui Pinto. Cityβs servers were breached, allowing Pinto to retrieve thousands of emails and documents from the clubβs systems.
This week, almost 10 years on from Pintoβs first email, the Premier League announced that an independent panel had found City guilty of all but one of the charges against them, as The Athletic first revealed last Friday.
π @jwhitey98: nyti.ms/4z5sgoL
1. Sham contracts with partners
2. Misleading auditors
3. Hid the books from the league
4. Β£900m fake revenue / cut costs
5. Misstated accounts
6. Smashed PL spending limits
7. Smashed UEFA FFP limits
8. Failed to report true income and spend.
Hat-trick hero π₯
@ManUtd's Bruno Fernandes is your Player of the Matchweek for his match-winning performance vs Ipswich π
Watch his highlights here π preml.ge/7vx1j1s6
Our #UCL opponents that weβll face from Pots 2-4:
π Roma (H)
π Sporting (A)
π RB Leipzig (H)
π Villarreal (A)
π Sabah (H)
π Como (A)
Premier League Player of the Season.
Man Utd Player of the Season.
FWA Footballer of the Year.
PFA Playersβ Player of the Year.
The 2025-26 season belongs to Bruno Fernandes.