2 min read
In a significant development in the ongoing lawsuit between WhatsApp and the Israeli spyware firm NSO Group, a company lawyer has publicly named Mexico, Saudi Arabia, and Uzbekistan as clients accused of being involved in the 2019 Pegasus spyware attacks.
This marks the first time NSO Group has officially acknowledged any of its customers, after years of maintaining silence on its clientele. The admission came during a recent court hearing, where the company’s legal representative revealed that at least eight clients were identified in the discovery process, three of whom were disclosed by name.
The case, initiated by Meta-owned WhatsApp in 2019, alleges that NSO Group exploited a vulnerability in WhatsApp’s systems to target around 1,400 users between April and May of that year. Victims included human rights defenders, journalists, and members of civil society. Over 100 such individuals were reportedly identified with assistance from Citizen Lab, a group known for investigating digital surveillance abuses.
According to court documents, 1,223 users across 51 countries were affected during the spyware campaign. Although Saudi Arabia was not on the country list, NSO’s legal team suggested that Pegasus licenses are restricted to specific territories, yet some customers may have operated beyond those geographic bounds.
Historical evidence supports such claims: in 2017, a Mexican government client allegedly used Pegasus to target a journalist’s child while the individual was in the United States.
The latest revelations raise further questions about NSO Group’s oversight and client monitoring mechanisms. A judge noted that the evidence available remains unclear about which specific clients were behind the 2019 attacks and whether internal vetting procedures were followed.
WhatsApp, meanwhile, is pushing for a court ruling that not only determines financial damages but also seeks to block NSO from conducting future surveillance via its platform.
While NSO Group has declined to comment on the case, it has not denied that Mexico, Saudi Arabia, and Uzbekistan were among its customers during the period in question. Human rights organizations continue to call for greater transparency and accountability in the global spyware industry, citing past abuses in countries like Mexico, Hungary, and the UAE.
