New Delhi: Six years after WhatsApp told the Indian government that 121 Indian users were targeted by the Israeli spyware Pegasus, new documents exhibited in its lawsuit against malware makers NSO Group say that 100 Indians were impacted.The document finds that Indians are the second-highest in number among Pegasus-affected, globally. The country with the most WhatsApp hacking victims is Mexico, which has 456 such people.WhatsApp, owned by Mark Zuckerberg’s Meta, had filed this lawsuit against the NSO Group in 2019. In late 2024, a US district court found the NSO Group liable in the lawsuit.The document published on April 4 is the first insight into where Pegasus victims are located across the world. It recorded 1,223 specific victims across 51 countries. After Mexico (456) and India (100), there are Bahrain (82), Morocco (60), Pakistan (58), Indonesia (54), and Israel (51).Pegasus is a sophisticated spyware which can infect phones without the user clicking on a single link.In 2021, The Wire was among an international consortium of news outlets which had unveiled the use of Pegasus with the help of a leaked list of potential surveillance.The NSO Group, as this consortium had reported then, says it only offers its spyware to “vetted governments”. During the 2021 news investigations, the company had refused to make its list of customers public.The Supreme Court had in 2021 ordered an inquiry into these reported findings. A technical committee set up by it found malware in five phones but could not say if it was or was not Pegasus. The Indian government, when asked, refused to confirm or deny that it had acquired and used Pegasus, citing national security.A report on TechCrunch notes that the WhatsApp lawsuit spotlights the hacking campaign targeting its users over a period of only two months, “between in and around April 2019 and May 2019”. This shows that in just two months, vetted government customers of the NSO Group targeted over a thousand WhatsApp users globally.The Israeli tech site CTech, which first reported on the WhatsApp country-wise numbers, also said that a country’s inclusion on the list does not necessarily mean it was an NSO client. “Syria, for example, is listed with 11 victims – despite being a country to which NSO is barred from selling Pegasus. These may have been targeted by third countries or intelligence services.”However, the range of persons who may have been selected for targeting – the likes of opposition politicians, journalists and activists – strongly suggests that the agency operating the spyware on Indian numbers could be an official Indian one. The phones of at least three of The Wire’s journalists – including two founding editors – were attacked with the spyware, the Amnesty Lab had found.
