The decision comes after five years of courtroom appearances led by NSO’s covert use of its surveillance tool, Pegasus, to exploit a vulnerability in the messaging app.

The judgment, delivered in a California federal court, includes $167,254,000 in punitive damages and an additional $444,719 in compensatory payments to cover the disruption caused to WhatsApp’s operations.

For the Meta-owned company, this is a rare legal blow to a spyware vendor with a long history of enabling government surveillance against journalists, dissidents, and civil society figures.

In a direct response to the ruling, WhatsApp’s spokesperson Zade Alsawah stated: “Our court case has made history as the first victory against illegal spyware that threatens the safety and privacy of everyone.”

The 2019 breach, which exploited WhatsApp’s call feature, allowed Pegasus to infiltrate users’ devices even if the call wasn’t answered. Victims were spread across at least 20 countries and included human rights activists, journalists, and government officials.

Meta’s legal team argued that NSO Group not only violated state and federal laws but also breached WhatsApp’s terms of service, which explicitly prohibit malicious access.

The judge in the case, Phyllis Hamilton, had already ruled in December that NSO was legally liable, and this week’s verdict focused solely on damages.

The outcome may resonate far beyond WhatsApp or Meta. As the trial unfolded, the inner workings of NSO Group’s operations were exposed, including client lists and the extent of its surveillance infrastructure.

Will Cathcart, the head of WhatsApp, had previously warned: “This should serve as a wake-up call for technology companies, governments and all Internet users. Tools that enable surveillance into our private lives are being abused, and the proliferation of this technology into the hands of irresponsible companies and governments puts us all at risk.”

Despite the scale of the damages, NSO Group has not backed down. Its spokesperson, Gil Lainer, suggested the company would not accept the decision quietly: “We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal.”

NSO has consistently argued that its spyware serves national security interests by assisting governments in tackling crime and terrorism.

But critics reject this defence. John Scott-Railton, a senior researcher at Citizen Lab and long-time investigator of NSO, described the ruling as a turning point:

“NSO makes many millions of dollars helping dictators hack people. After years of every trick and delay tactic, it only took the jury a day’s deliberation to see right through to the heart of the matter: NSO’s business is based on hacking American companies…so that dictators can hack dissidents.”

He added: “The company emerges from this trial severely damaged. Aside from the huge punitive damages, the bigger impact of this case has also been a huge blow to NSO’s efforts to hide their business activities.”

Meta has indicated that the damages will be channelled to organisations working to defend digital rights and protect users against invasive surveillance.

This case with WhatsApp may not be the last challenge for NSO Group. The U.S. Commerce Department had already sanctioned the company in 2021, and tech giants like Apple have pursued similar legal action. 

The attack, traced to Israeli spyware firm Paragon, was carried out using malicious PDF files sent via WhatsApp groups.

A spokesperson for WhatsApp confirmed that affected users had been notified and that measures had been taken to prevent similar incidents in the future.

“We’ve reached out directly to people who we believe were affected. This is the latest example of why spyware companies must be held accountable for their unlawful actions. WhatsApp will continue to protect people’s ability to communicate privately,” said Zade Alsawah, a spokesperson for the messaging platform.

Paragon, which was acquired by American private equity firm AE Industrial in December, has not commented on the allegations. WhatsApp stated that the attack took place in December and that a cease-and-desist letter had been sent to Paragon in response.

John Scott-Railton, a senior researcher at Citizen Lab, confirmed that his team had been investigating the hacking campaign. He noted that Paragon’s spyware had used the specific attack method identified by WhatsApp.

This is the first time Paragon has been publicly linked to a cyberattack of this nature. Unlike other spyware firms such as Intellexa and NSO Group—both of which have faced sanctions and legal scrutiny—Paragon has largely remained out of the spotlight. However, the recent revelations challenge its reputation as a more restrained player in the industry.

“For some time, Paragon has had the reputation of a ‘better’ spyware company not implicated in obvious abuses, but WhatsApp’s recent revelations suggest otherwise,” said Natalia Krapiva, senior tech-legal counsel at Access Now. “This is not just a question of some bad apples—these types of abuses are a feature of the commercial spyware industry.”

The full extent of the attack is not yet known, and the identities of those targeted have not been disclosed. WhatsApp has reported the incident to law enforcement and industry partners while monitoring and countering spyware threats on its platform.