NSO Group’s Pegasus spyware was used to target 1,223 WhatsApp users across 51 countries during a 2019 hacking campaign, according to a court document published as part of WhatsApp’s lawsuit against the surveillance tech firm.
The document provides a rare insight into the locations of victims targeted by NSO Group’s Pegasus spyware, revealing that the countries with the most victims were Mexico (456), India (100), Bahrain (82), Morocco (69), Pakistan (58), Indonesia (54), and Israel (51).
A chart titled “Victim Country Count,” submitted by WhatsApp as part of the case, also shows that Western countries such as Spain (21), the Netherlands (11), Hungary (8), France (7), the United Kingdom (2), and the United States (1) were not spared from the targeting.
The hacking campaign, which occurred between April and May 2019, highlights the scale of the government spyware problem, with Runa Sandvik, a cybersecurity expert, noting that the true scale of targeting often goes unreported.
Sandvik commented that the list of victims “speaks volumes about the true scale of the spyware problem,” particularly in countries like Mexico, where 456 cases were documented, and where there are known civil society victims.
It’s worth noting that the presence of a victim in a particular country does not necessarily indicate that the country’s government was the customer using NSO Group’s spyware. A government customer could potentially target individuals outside of their country.
The number of victims in a country may also provide insight into NSO Group’s highest-paying customers, as the company determines the price of its surveillance products based on the number of targets that can be concurrently infected.
Mexico, for example, was reported to have spent over $60 million on NSO Group’s spyware, according to a 2023 New York Times article, which could explain the high number of Mexican targets.
Last year, WhatsApp achieved a significant victory in the lawsuit when the judge ruled that NSO Group had breached U.S. hacking laws by targeting WhatsApp users. The next step in the lawsuit is a hearing to determine the damages NSO Group will have to pay to WhatsApp.
The court case has already led to other revelations, including that NSO Group disconnected 10 government customers after reports of abuse and that a single license for NSO’s WhatsApp hacking tool cost up to $6.8 million per year, generating at least $31 million in revenue in 2019.
