In 2020, a leaked list of more than 50,000 phone numbers reached Forbidden Stories and Amnesty International. Their investigation, shared with 17 media organizations, began publishing findings on 18 July 2021. The list included journalists, lawyers, activists, opposition politicians, diplomats and heads of state; reporting identified nearly 200 journalists across 24 countries. A number appearing on the list was not by itself proof of infection, but Amnesty’s forensic examinations found Pegasus indicators on selected devices, and France’s ANSSI independently confirmed infections on three journalists’ phones. The spyware, developed by Israeli cyber-arms company NSO Group, could exploit mobile devices and provide access to messages, photographs, files, microphones, cameras and location data. NSO said Pegasus was licensed only to vetted governments for serious crime and terrorism investigations and denied that the list was reliable evidence of misuse.
The disclosures triggered investigations and political consequences. French President Emmanuel Macron, whose number appeared as a potential target, changed his phone and ordered a security overhaul. On 4 November 2021, Hungarian lawmaker Lajos Kósa acknowledged that the Interior Ministry had purchased and used Pegasus, while Poland’s Central Anticorruption Bureau bought 40 licenses for PLN 33.4 million in 2017; Citizen Lab later reported hacks of Polish opposition figures during the 2019 election period. AWS terminated infrastructure linked to NSO after Amnesty found Amazon CloudFront used in infections. Israel tightened cyber-arms export rules in December 2021, and Poland’s parliament opened a Pegasus inquiry on 17 January 2024 covering alleged operations from 2015 through 2023. The case intensified demands for accountability and restrictions on the international spyware trade.
