WhatsApp Wins Landmark $6M NSO Group Hacking Case
Table of Contents
Case Background
This case came before Judge Phyllis J. Hamilton in the federal court in Oakland, California. The Plaintiffs, WhatsApp Inc. and Facebook Inc., sued NSO Group Technologies and Q Cyber Technologies. The complaint stated that NSO Group created and used surveillance software called “Pegasus” to hack approximately 1,400 mobile phones between April and May 2019. The hacking targeted attorneys, activists, journalists, and diplomats. Plaintiffs argued that NSO violated federal and state anti‑hacking laws, their Terms of Service, and caused serious damage to their computer servers.
The cause that led to the dispute
The case centred on NSO Group’s use of malware disguised as ordinary calls. The software bypassed WhatsApp’s security measures and infected phones, extracting data such as texts, voice calls, and files. WhatsApp and Facebook claimed that this was unauthorised access that violated the Computer Fraud and Abuse Act (CFAA), the California Comprehensive Computer Data Access and Fraud Act, and breach of contract for ignoring their Terms of Service.
Injuries suffered
The hacking left Plaintiffs with substantial losses. They had spent significant resources to investigate and fix the breach. The unauthorised access also weakened trust in their service, potentially harming their reputation and relationships with millions of global users.
Damages sought
The Plaintiffs sought damages for losses caused by NSO Group’s unlawful intrusion. These included recovery of investigation and remediation expenses, damages for reputational harm, and punitive damages.
Key Arguments and Proceedings
Legal Representation
Plaintiff(s): WhatsApp Inc. and Facebook Inc.
· Counsel for Plaintiffs: Shawn D. Morris | Christian W. Barton
Defendant(s): NSO Group Technologies Limited and Q Cyber Technologies Limited
· Counsel for Defendants: Joseph N. Akrotirianakis | Aaron S. Craig
Key Arguments by Counsel
Plaintiffs argued that NSO Group intentionally violated the Terms of Service, using sophisticated malware to bypass security and gain access to private conversations. They stated NSO acted far beyond any authorised use of the platform. The Defendants responded by denying any direct role in the attack and asserted that their software had been used by state customers under legitimate national security and law enforcement operations.
Claims Asserted
Computer Fraud and Abuse Act
Plaintiffs alleged that NSO Group violated the federal statute by accessing and extracting data from protected devices.
California Penal Code §502
The Plaintiffs asserted that NSO Group violated state law by accessing and altering data and using their servers to send unauthorised malware.
Breach of Contract
The Plaintiffs stated that NSO Group violated WhatsApp’s Terms of Service agreement.
Defense Arguments
The Defendants argued that their acts were conducted by sovereign state customers for legitimate security and law enforcement reasons. They stated that the court lacked subject matter and personal jurisdiction, and that the Plaintiffs failed to prove damages caused by their actions.
Jury Verdict
On May 6, 2025, the jury found in favour of WhatsApp Inc. and Facebook Inc. The jury concluded that NSO Group acted intentionally and violated federal and state computer intrusion laws and the Plaintiffs’ Terms of Service. The verdict confirmed NSO Group’s role in the unauthorised access and awarded damages to the Plaintiffs. The judgment included compensation for the cost of investigation and other losses, making it a pivotal ruling for digital privacy and cybersecurity enforcement.
Court documents are available upon request at jurimatic@exlitem.com