Browse Conspiracy Theories

Maltese investigative journalist and blogger Daphne Caruana Galizia was killed by a car bomb on 16 October 2017 near her home in Bidnija, Malta. Her 'Running Commentary' blog had exposed Pilatus Bank, the Electrogas gas power station deal, and the Malta angle of the Panama Papers. Yorgen Fenech, an Electrogas businessman, was charged with complicity in murder in November 2019. Vincent Muscat pleaded guilty in February 2021 (sentenced to 15 years); Alfred and George Degiorgio were convicted in October 2022 (sentenced to 40 years). A public inquiry concluded in July 2021 that the state bore responsibility for the conditions that enabled the killing. Prime Minister Joseph Muscat resigned in January 2020 following related revelations.

Pakistan Peoples Party leader Benazir Bhutto was assassinated on 27 December 2007 at Liaquat National Bagh in Rawalpindi following a political rally. She had returned from exile in October 2007 after receiving an amnesty from President Pervez Musharraf. A combination of gunshots and a suicide bomb attack killed her and more than twenty others. The Musharraf government's initial claim that she died from striking her head on the vehicle sunroof was contradicted by medical and forensic evidence. The 2010 UN Commission of Inquiry (chaired by Heraldo Muñoz) found that police had hosed down the crime scene within ninety minutes of the attack, destroying critical evidence. TTP attribution to Baitullah Mehsud remains disputed. Five individuals were convicted in 2017; Musharraf was charged in absentia.

Germanwings Flight 9525, an Airbus A320 registration D-AIPX, was deliberately crashed into the French Alps on 24 March 2015 by co-pilot Andreas Lubitz, killing all 150 on board. Captain Patrick Sondenheimer was locked out of the cockpit; Lubitz set the autopilot to 100 feet and held the descent until impact. The BEA final report (March 2016) confirmed deliberate action. Lubitz had concealed a history of depression treatment and suicidal ideation from aviation medical authorities, enabling him to hold an unrestricted licence. The crash drove major changes to cockpit access rules and medical disclosure requirements across European and global aviation.

Helios Airways Flight 522, a Boeing 737-300 registration 5B-DBY, crashed near Grammatiko, Greece, on 14 August 2005, killing all 121 aboard. The pressurization mode selector had been left in MANUAL during a maintenance check and not returned to AUTO before flight. The crew misdiagnosed the resulting cabin altitude warning as a takeoff configuration horn, failed to recognise hypoxia onset, and became incapacitated at cruise altitude. The aircraft flew on autopilot toward Athens while Hellenic Air Force F-16s intercepted it and found the flight deck unresponsive. Flight attendant Andreas Prodromou, a trained pilot, briefly assumed control before the aircraft crashed after fuel exhaustion. The Cypriot AAIASB report (2006) confirmed decompression as cause.

Delta Air Lines Flight 191, a Lockheed L-1011 TriStar approaching Dallas/Fort Worth International Airport on 2 August 1985, encountered a microburst-induced windshear during approach to Runway 17L. The sudden loss of airspeed at low altitude caused the aircraft to impact the ground near Highway 114. Of the 163 aboard, 137 died — 128 passengers, 8 crew, and 1 ground fatality (motorist Sherrod Williams). The NTSB report (August 1986) identified the accident as the first fatal US accident definitively attributed to microburst windshear. It directly drove FAA deployment of Terminal Doppler Weather Radar (TDWR) and mandatory windshear training from 1988 to 1994.

On 27 June 2017 a destructive malware campaign — publicly branded NotPetya — erupted from Ukraine and spread globally within hours, masquerading as ransomware while in reality being a pure wiper designed to maximise damage. US CISA, UK NCSC, and Five Eyes partners attributed the attack to Russian GRU Unit 74455 (Sandworm) in February 2018; the US DOJ indicted six GRU officers in October 2020. The supply-chain entry point was a trojanised update to M.E.Doc, a Ukrainian accounting software package used by roughly 80 percent of Ukrainian businesses. Global losses exceeded $10 billion, making it the costliest cyberattack in recorded history.

On 23 December 2015, cyberattackers disrupted electricity supply to approximately 230,000 customers in Ukraine's Ivano-Frankivsk Oblast for one to six hours — the first publicly confirmed successful cyberattack on civilian power grid infrastructure anywhere in the world. US-CERT (IR-ALERT-H-16-056-01), the Ukrainian SBU, and security researchers attributed the attack to Sandworm (GRU Unit 74455), who used spear-phishing to compromise three Ukrainian regional electricity distribution companies, deployed the BlackEnergy malware and KillDisk wiper, and launched a telephony denial-of-service to hamper restoration. A follow-on attack on 17 December 2016 (Industroyer/Crash Override) struck the Kiev transmission substation.

Between August 2016 and April 2017, an anonymous group calling itself the Shadow Brokers released a series of files containing what appeared to be NSA Equation Group/Tailored Access Operations (TAO) cyberweapons, including the EternalBlue, EternalRomance, EternalSynergy, and DoublePulsar exploits. Microsoft patched the primary vulnerability (MS17-010) on 14 March 2017 after a pre-disclosure from the NSA; within two months the exploits were weaponised in WannaCry (May 2017) and NotPetya (June 2017). The identity and affiliation of the Shadow Brokers has never been definitively established; leading theories include Russian intelligence theft, an NSA insider, or both.

Between 27 November and 18 December 2013, attackers stole 40 million payment-card numbers and 70 million records of personal information from Target's point-of-sale systems. Entry was gained via stolen credentials belonging to Fazio Mechanical Services, an HVAC vendor with network access. BlackPOS RAM-scraping malware was installed on Target's POS terminals. Journalist Brian Krebs first disclosed the breach publicly on 18 December 2013, the same day Target confirmed it. CEO Gregg Steinhafel resigned on 5 May 2014; CIO Beth Jacob resigned in March 2014. Target reached an $18.5 million settlement with state AGs in May 2017. Total costs exceeded $300 million.

The Marriott Starwood breach exposed approximately 339 million guest records — including passport numbers, encrypted payment card details, and travel history — from a database that had been compromised since 2014. Marriott acquired Starwood Hotels in September 2016 without discovering the intrusion, which continued for more than two years post-acquisition. The breach was disclosed on 30 November 2018. US and UK intelligence attributed the attack to APT10, a hacking group linked to China's Ministry of State Security, based on tools and techniques. The UK's ICO issued an initial GDPR fine of £99.2 million in July 2019, subsequently reduced to £18.4 million in October 2020. Seven million UK records were affected.

The Equifax breach exposed the personally identifiable information of 147.9 million Americans — Social Security numbers, dates of birth, addresses, and driver's licence numbers — via an unpatched Apache Struts vulnerability (CVE-2017-5638). The patch was available on 8 March 2017; the breach began on 13 May 2017 and was discovered internally on 29 July 2017. Equifax did not disclose publicly until 7 September 2017. In the interim, the company's CFO and three other executives sold approximately $1.8 million in stock. Two officers — Jun Ying and Sudhakar Bonthu — were later charged with insider trading. CEO Richard Smith resigned on 26 September 2017. The $700 million FTC and state AG settlement in July 2019 remains one of the largest data-breach settlements in US history.

AT&T technician Mark Klein revealed in 2006 that a secret room on the 7th floor of AT&T's 611 Folsom Street facility in San Francisco had been equipped with a Narus STA 6400 deep-packet inspection system fed by a fiber-optic splitter. Klein's sworn declarations in EFF v. AT&T (Hepting) showed AT&T had allowed the NSA to tap internet backbone traffic without warrants. The New York Times had disclosed the broader warrantless wiretap program in December 2005. The FISA Amendments Act of 2008 granted retroactive immunity to telecoms. The room and the surveillance program are confirmed.

On 6 June 2013, the Washington Post (Barton Gellman) and The Guardian (Glenn Greenwald) simultaneously published NSA PowerPoint slides leaked by contractor Edward Snowden revealing PRISM — a Section 702 Foreign Intelligence Surveillance Act program that compelled direct upstream data collection from Google, Facebook, Yahoo, Microsoft, Apple, AOL, Skype, YouTube, and PalTalk. NSA Director Keith Alexander testified to Congress. The Privacy and Civil Liberties Oversight Board (PCLOB) issued a detailed 2014 report confirming the program's scope. Companies denied 'direct access' but acknowledged compliance with court orders. The program is confirmed.

On 21 June 2013, The Guardian published reporting by Ewen MacAskill, Julian Borger, and Nick Hopkins revealing TEMPORA — a GCHQ program operating from the Bude facility in Cornwall that tapped more than 200 transatlantic fiber-optic cables and buffered up to 21 petabytes of data per day on a rolling 3-day storage window. Related programs included INCENSER, MUSCULAR (shared with NSA), and CARBOY. The Investigatory Powers Act 2016 codified UK bulk collection powers. The European Court of Human Rights ruled in Big Brother Watch v UK (2018, 2021) that some UK interception practices violated ECHR Article 8. Confirmed.

On 3 October 2021 the ICIJ and 600+ journalists across 117 countries published findings from 11.9 million documents leaked from 14 offshore service providers operating in jurisdictions including the British Virgin Islands, Panama, Belize, Cyprus, UAE, Switzerland, and Singapore. The Pandora Papers were the largest offshore financial data leak in history at that point. Subjects included 35 current and former world leaders: Tony Blair (avoided £312,000 in stamp duty via an offshore property acquisition), King Abdullah II of Jordan ($106 million in property acquisitions through offshore vehicles), Czech PM Andrej Babiš (purchased a French Riviera château through a BVI chain), Kenya's President Uhuru Kenyatta and his family, and Putin associates including Konstantin Ernst and Svetlana Krivonogikh.

On 5 November 2017 the International Consortium of Investigative Journalists (ICIJ), Süddeutsche Zeitung, and 95 media partners published findings from 13.4 million documents leaked from Appleby (a Bermuda-based offshore law firm), Asiaciti Trust, and 19 corporate registries. The disclosures exposed Apple's tax-minimisation restructuring in Jersey after the EU's 2013 ruling against its Irish structure; Glencore's Democratic Republic of Congo operations; Nike's Bermuda subsidiary arrangements; US Commerce Secretary Wilbur Ross's undisclosed financial ties to Navigator Holdings and its Russian clients; Queen Elizabeth II's Duchy of Lancaster investments; and Bono's investment in a Lithuanian shopping mall via an offshore vehicle. Approximately 120 politicians were implicated.

UBS AG, Switzerland's largest bank, admitted in a February 2009 deferred prosecution agreement that it had helped approximately 20,000 US clients evade taxes through secret offshore Swiss accounts. UBS paid $780 million and turned over 4,450 account names. Whistleblower Bradley Birkenfeld received a $104 million IRS award in 2012. The scandal triggered the Foreign Account Tax Compliance Act (FATCA) in 2010, the US-Switzerland tax treaty in 2009, and a broader 2013 Swiss bank amnesty programme. Wegelin Bank — Switzerland's oldest — was indicted and closed in 2013.

Enron Corporation, once the seventh-largest company in the United States, collapsed into bankruptcy on 2 December 2001 after executives used Special Purpose Entities — named Raptor, JEDI, Chewco, LJM1, and LJM2 — to hide more than $30 billion in debt off the balance sheet. CEO Jeffrey Skilling and Chairman Kenneth Lay promoted a fraudulent mark-to-market accounting regime that allowed Enron to book speculative future profits as current income. Stock peaked at $90.75 in August 2000; within 16 months the company was worthless. More than 4,000 employees lost jobs and pensions. The fraud was confirmed by congressional investigations, SEC findings, and criminal convictions.

WorldCom Inc., the second-largest long-distance telecom company in the United States, was revealed in June 2002 to have executed an $11 billion accounting fraud — the largest in US history at the time. Internal auditor Cynthia Cooper and her team discovered that CFO Scott Sullivan and Controller David Myers had misclassified at least $3.8 billion in operating expenses as capital expenditures, artificially inflating reported EBITDA and earnings. CEO Bernie Ebbers was convicted of fraud, conspiracy, and filing false documents (25-year sentence, July 2005). WorldCom filed for Chapter 11 bankruptcy on 21 July 2002, listing $107 billion in assets — surpassing Enron as the largest US bankruptcy filing to that date.

Traders at major global banks — including Citigroup, JPMorgan Chase, Barclays, Royal Bank of Scotland, UBS, Bank of America, and HSBC — coordinated manipulation of the WM/Reuters 4pm London foreign exchange benchmark fix through private Bloomberg chat rooms with names including "The Cartel," "The Bandits Club," and "The Mafia." The conspiracy was revealed by Bloomberg News and investigated by the UK Financial Conduct Authority from June 2013. By May 2015, regulators in the United States, United Kingdom, Switzerland, and elsewhere had imposed $5.6 billion in combined fines. Five banks pleaded guilty to US antitrust violations. The conspiracy ran from approximately 2007 to 2013 and affected the pricing of currencies traded by pension funds, corporations, and sovereign wealth funds worldwide.

A myocarditis safety signal following mRNA COVID-19 vaccines was detected by Israeli health authorities in April 2021. The CDC ACIP confirmed elevated risk in young males at its June 2021 meeting, and FDA + manufacturer labels were updated by July 2021. Peer-reviewed studies (Patone et al Nature Medicine 2022; Le Vu et al Nature Communications 2022) confirmed the signal. Israeli Ministry of Health internal documents released via FOI in 2022 showed earlier internal awareness than public statements. The myocarditis risk in young males (approximately 1-10 per 100,000 doses) and its generally favourable recovery profile are not disputed. Whether the disclosure timeline constitutes 'concealment' or 'appropriate regulatory process' is the contested framing question.

Simian Virus 40 (SV40) was discovered in 1960 in rhesus monkey kidney cells used to produce both the Salk inactivated polio vaccine and early Sabin oral polio vaccine. An estimated 10-30 million Americans and up to 100 million people globally received SV40-contaminated polio vaccines between 1955 and 1963. NIH virologist Bernice Eddy detected the contamination in 1960 but stockpiles continued to be used. SV40 causes sarcomas in hamsters and was subsequently detected in human tumours. The IOM 2002 review concluded the biological mechanism was plausible but epidemiologic data were inconclusive. Contamination is documented fact; cancer causation in humans remains contested.

The 1918 influenza pandemic killed an estimated 50-100 million people worldwide. The 'Spanish' label arose not because Spain was the source but because Madrid newspapers — uncensored by wartime press restrictions — reported freely on the outbreak. Three competing origin hypotheses have been advanced: Camp Funston, Kansas (USA); the Étaples British Army camp in France; and a Chinese-labour-corps theory. Genetic phylogenetic analysis has reconstructed the H1N1 genome but has not resolved the geographic origin debate. The origin remains scientifically contested among researchers.