On October 30, 2019, WhatsApp's parent company Facebook, Inc. confirmed that Pegasus, a sophisticated snooping software developed by Israel's NSO Group, was used to target Indian journalists, activists, lawyers and senior government officials. The journalists and activists are believed to have been targets of surveillance for a two-week period until May, when the Indian national election was held.
The snooping scandal came out after WhatsApp filed a case in California's Northern District federal court against the NSO group, alleging the NSO group had developed the software used to infect 1,400 target devices with malware.
The IT Ministry of India sought a detailed response from WhatsApp on the issue. They responded that they had alerted the government on two occasions—once in May and for the second time in September 2019. In response to Indian Government's order, WhatsApp informed the Computer Emergency Response Team of India in May and September that Pegasus spyware affected Indian WhatsApp users.
Indian National Congress party alleged that the Narendra Modi-led government has been caught snooping on journalists, activists, lawyers and senior government officials. They later alleged that their leaders, including general secretary Priyanka Gandhi, are also being targeted by this. They also claimed WhatsApp sent messages to different people whose phones were hacked. One such message was also received from the WhatsApp of Priyanka Gandhi a few months ago.
Former Chief Financial officer of Infosys Mr. T.V. Mohandas Pai also demanded government to probe on the scandal and to come out with a report before the public.
In 2024, the lawsuit in Northern Californian was ruled by a federal judge that the NSO group was liable for infecting devices belonging to 1,400 Whatsapp users. NSO group was ordered to pay 4 million dollars to Meta as of May 2025 and was barred from targeting Whatsapp users in the future.
Broader context of Pegasus spyware usage The WhatsApp incident was part of a larger pattern of Pegasus spyware abuse. Investigations by the Pegasus Project (2021) revealed that governments worldwide used the malware to target journalists, activists, and politicians, including associates of murdered Saudi journalist Jamal Khashoggi and staff of French President Emmanuel Macron.
Technical details The attack exploited CVE-2019-3568, a zero-click exploit vulnerability in WhatsApp's VoIP stack. The exploit allowed installation of Pegasus spyware without any user interaction. WhatsApp patched the vulnerability through server-side fixes and client updates in May 2019.
Global legal repercussions Beyond lawsuits in the U.S. and India, the scandal prompted regulatory scrutiny in the European Union, where lawmakers questioned NSO Group's compliance with GDPR requirements. The Israeli government subsequently tightened oversight of cyberweapon exports.
In 2024, the Northern Californian lawsuit ruled that the NSO group was liable for infecting devices belonging to 1,400 Whatsapp users. The federal acts violated were the Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act in addition to WhatsApp’s terms of service. The original 167 million amount ordered to be paid was then later adjusted to 4 million in accordance to proper standard due to a maximum cap on punitive damage charges. The ruling also included an order for NSO group to cease targeting Whatsapp users in the future and delete data extracted from targeted users in the case.
NSO Group's response NSO Group maintained that Pegasus was licensed exclusively to governments for counterterrorism purposes. The company stated it had no visibility into how clients used the software, though this claim was disputed by researchers. NSO claimed the ruling by the Northern California lawsuit for NSO to cease its targeting of Whatsapp users would "force NSO out of business," given that nature of the Pegasus product, which the judge found to be insignificant compared to the harm Pegasus posed to the privacy and safety of Meta and their users.
Impact on WhatsApp Following the disclosure, many users migrated to alternative messaging platforms like Signal and Telegram. WhatsApp responded by enhancing its security communications and emphasizing its commitment to end-to-end encryption.
See also Pegasus Project (investigation) Pegasus Project revelations in India
References
Further reading Israeli Firm Used Flaw In WhatsApp for Spying, The New York times, 14 May 2019. Nicole Perlroth, WhatsApp Says Israeli Firm Used Its App in Spy Program, The New York Times, 29 October 2019, Craig Timberg, Jay Greene, "WhatsApp accuses Israeli firm of helping hack phones", The Washington Post, 30 October 2019. Mehul Srivastava, Tom Wilson, "Inside the WhatsApp hack", Financial Times, 30 October 2019. Stephanie Kirchgaessner, NSO Group points finger at state clients in WhatsApp spying case, The Guardian, 7 April 2020. Tara Seals, Facebook's NSO Group Lawsuit Over WhatsApp Spying Set to Proceed, Newstex (blog), 20 July 2020. Shannon Vavra, "Israeli Spyware Firm NSO Group Could Soon Be Spilling Its Secrets", The Daily Beast, 9 November 2021.