An Israeli company accused of supplying spyware to governments was linked to the disclosure of a list of 50,000 smartphone numbers of activists, journalists, business executives, and politicians around the world, according to reports released Sunday.
The NSO Group of Israel and its malware Pegasus have been in the headlines at the least since 2016 when investigators accused him of helping spy on a dissident in the United Arab Emirates.
The extent of Pegasus use was reported by The Washington Post, The Guardian, Le Monde, and other media outlets that collaborated on an investigation into a data breach.
The leak concerns more than 50,000 smartphone numbers believed to have been identified as belonging to persons of concern by NSO customers since 2016, the publications said.
The Post noted that the list was shared with the media by Forbidden Stories, a Paris-based nonprofit journalistic organization, and Amnesty International. The newspaper said the total number of phones attacked or monitored is unknown.
The list includes numbers of journalists from media from around the world, such as Agence France-Presse, The Wall Street Journal, CNN, The New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, The Economist, Reuters and Voice of America, The Guardian said.
The use of the software to hack the phones of Al-Jazeera reporters and a Moroccan journalist had previously been reported by Citizen Lab, a research center at the University of Toronto, and Amnesty International.
Also listed are two numbers belonging to women close to Saudi-born journalist Jamal Khashoggi, who was killed by a Saudi squad in 2018.
It also includes the number of an independent Mexican journalist who was later murdered in a car wash. His phone was never found and it is unclear if it was hacked.
The Post said the numbers on the list are not attributed, but media outlets involved in the project were able to identify more than 1,000 people from more than 50 countries.
Including several Arab royals, it was at the least 65 business executives, 85 activists of human rights, 189 journalists, and more than 600 politicians and government officials, including heads of state and government and ministers.
According to reports, many numbers on the list were concentrated in 10 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, and the United Arab Emirates.
Pegasus, the report notes, is a highly invasive tool that can turn on the camera and microphone of a target person's phone, as well as access data on the device, effectively turning a phone into a pocket spy.
In some cases, it can be installed without tricking the user into downloading.
In a statement released Sunday, NSO said the Forbidden Stories report is "full of erroneous assumptions and unsubstantiated theories," and threatened to file a defamation lawsuit against the organization.
"As NSO has previously stated, our technology is in no way related to the heinous murder of Jamal Khashoggi," the company said.
"We would like to emphasize that NSO sells its technologies only to law enforcement and intelligence agencies of certain governments for the sole purpose of saving lives by preventing crime and terrorist acts," he noted.
Citizen Lab reported in December that the mobile devices of more than three dozen journalists from Qatar's Al-Jazeera network had been attacked by Pegasus.
Amnesty International reported in June last year that Moroccan authorities used NSO malware to insert spyware into the cell phone of Omar Radi, a journalist convicted of a post on social media.
At the time, NSO said it was "deeply concerned about the allegations" and was reviewing the information.
Founded in 2010 by Israelis Shalev Hulio and Omri Lavie, NSO is based in the Israeli high-tech center of Herzliya, near Tel Aviv, and claims that it employs hundreds of people in Israel and around the world.