NSO Group will have to pay more than $167 million in damages to WhatsApp for 2019 hacking campaign

Six years back, WhatsApp engineers detected and stopped an attack by NSO using its spyware tool Pegasus to target over a thousand WhatsApp users, including human rights activists, journalists, diplomats and others in civil society.

Since then, NSO and WhatsApp have been in a five-year legal battle. Yesterday, a jury ruled that NSO Group must pay $167,254,000 in punitive damages and around $444,719 in compensatory damages to WhatsApp. This is a huge win for WhatsApp.

In an official statement, the company mentioned, “Today the jury’s decision to force NSO, a notorious foreign spyware merchant, to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve.”

The trial also revealed that WhatsApp was far from NSO’s only target. While WhatsApp stopped the attack vendor that exploited their calling system in 2019, Pegasus had many other spyware installation methods to exploit other companies’ technologies NSO was forced to admit that it spends tens of millions of dollars annually to develop malware installation methods including through instant messaging, browsers, and OS, and that its spyware is capable of compromising iOS or Android devices to this day.

Last December, WhatsApp won against NSO Group. Judge Phyllis Hamilton, who presided over the case, ruled that NSO Group was liable for breaching federal and California hacking laws in its 2019 spyware campaign against 14,000 WhatsApp users. The judge ruled that NSO Group was also liable for breaching WhatsApp’s terms of service, which prohibit the use of the app for malicious purposes. At that point, the case moved on to a jury trial to determine what damages the spyware company owed WhatsApp which has now concluded.