In January 2016, climate advocates and lawyers gathered at the Rockefeller Family Fund’s office in Manhattan to strategize efforts to hold Exxon Mobil accountable for climate change, following revelations that the company’s scientists had identified climate risks decades earlier while the company funded denial campaigns. Within weeks, members of this group and other environmental advocates began receiving phishing emails that appeared to come from social media platforms. When some clicked the malicious links and entered passwords, they realized they were being targeted by a coordinated hacking operation.
Investigations by University of Toronto researchers and the Department of Justice eventually identified the hackers as Dark Basin, a hack-for-hire group based in India. The operation targeted thousands of people across six continents, including politicians, prosecutors, journalists, and human rights defenders. However, the identity of who commissioned the hacking campaign remained unknown for years. In 2019, federal agents arrested Israeli private investigator Aviram Azari at Kennedy Airport on hacking charges. Azari later pleaded guilty and cooperated with investigators, revealing he had managed multiple hacking projects earning more than $4.8 million over nearly five years.
The breakthrough came when the U.S. government issued an arrest warrant for another Israeli private investigator, Amit Forlit, and sought his extradition from the United Kingdom. Court documents filed in Forlit’s extradition case alleged that a public affairs firm representing Exxon Mobil had commissioned the hacking operation. Forlit was extradited in April, and the unsealed federal indictment detailed how the scheme operated: a principal at a lobbying firm working for an oil corporation with headquarters in Irving, Texas, hired Forlit to gather intelligence on climate activists and groups critical of the company. Forlit then subcontracted hackers to target specific individuals’ accounts, with stolen materials funneled back through the chain to be used in the company’s litigation and lobbying efforts.
Exxon Mobil and DCI Group, the public affairs firm allegedly involved, have both denied involvement in any hacking activities. Exxon stated it condemns hacking and has not been involved in or aware of such activities. DCI Group stated it has been told by the government that neither the firm nor its personnel are under investigation. Forlit has pleaded not guilty to charges that could result in up to 45 years in prison. The victims, including climate advocate Kert Davies and Rockefeller Family Foundation leadership, have expressed hopes that the ongoing legal proceedings will reveal full details about who ordered and paid for the operation and confirm whether they were successfully hacked, with some still uncertain about their digital security years later.