Meta wins $168 million in damages from Israeli cyberintel firm in Whatsapp spyware scandal

OAKLAND, Calif. (CN) — Meta won nearly $168 million in damages Tuesday from Israeli cyberintelligence company NSO Group, capping more than five years of litigation over a May 2019 attack that downloaded spyware on more than 1,400 WhatsApp users’ phones.

An eight-person jury awarded the Silicon Valley giant $444,719 in compensatory damages, the monetary cost to Meta for fixing the attack, and over $167 million in punitive damages meant to deter any similar actions by NSO in the future.

The damages award also represents a major win for privacy advocates and human rights organizations, who have repeatedly criticized NSO for its licensing of Pegasus, a powerful surveillance software that allows its users to remotely gain control over a device’s microphone and camera, listen to phone calls in real-time and download nearly all user data from a target’s phone, among other capabilities.

“Today’s verdict in WhatsApp’s case is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone,” Meta said in a statement celebrating the win.

After its loss in court, NSO reaffirmed its commitment to Pegasus as a valuable tool in anti-terror operations around the world.

“We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies,” NSO spokesperson Gil Lanier told Courthouse News. “This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury’s consideration in this case.”

Although it is unclear how the decision will affect NSO, the company’s CEO, Yaron Shohat, previously testified that the company was in dire straits financially and wouldn’t be able to pay any damages awarded to Meta.

Shohat declined an interview outside the Ron V. Dellums Federal Courthouse, where the court proceedings were held.

Meta — owner of WhatsApp, an encrypted communication app owned by Facebook’s parent company Meta Platforms, which boasts over 2 billion users worldwide — sued the Israel-based firm in 2019 over violations of the U.S. Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act, as well as for breaching WhatsApp’s terms of service.

Because U.S. District Judge Phyllis J. Hamilton, a Bill Clinton appointee, had already ruled in Meta’s favor in December, the trial was only held to determine how much NSO owed in damages.

Trial began on April 28, 2025, when the jury of eight was selected from a pool of 33 potential jurors.

During the proceedings, the jury heard witness testimony from executives at Meta and NSO, experts in assessing damages and the software engineers who worked to fix the exploits NSO used to install malware on its users’ phones.

At trial, Meta had the burden of justifying that the $444,719 in compensatory damages it was asking for accurately represented the cost of the attack to its company, going as far as asking employees about their schedules and hiring a damages expert to assess the situation.

Meta also asked the jury to determine a fair amount of punitive damages, for which it had to prove that was guilty of “oppression, fraud or malice” under law. Although any one of these would have sufficed for damages,  Meta claimed all three were present in NSO’s conduct.

At the same time, NSO asked jurors to find zero dollars in damages, arguing that because its employees were salaried and there was no damage to the servers, Meta hadn’t actually suffered any losses.

In closing statements, Meta implored jurors to “send a message” to NSO that spying wouldn’t be tolerated in the U.S., nor in California.

The jury began deliberations Monday after six days of trial.

However, the case isn’t over quite yet. Meta still plans to argue a permanent injunction motion at an upcoming hearing, which would prevent NSO from using its platforms, emulating its technology or creating future WhatsApp accounts. Meta is also asking the court to order NSO to delete any code it still possesses related to its platforms.

The judge indicated she will schedule the hearing sometime in May or June.

Originally designed as a tool for government law enforcement and intelligence agencies, Pegasus — NSO’s flagship product licensed to governments around the world — reportedly compromised the privacy of 1,400 activists, journalists and diplomats via WhatsApp servers in 2019.

To embed the spyware into someone’s phone, Pegasus clients send a text message which then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.

Once implanted, it can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example by scraping browser history and contacts, grabbing screenshots and infiltrating communications.

Pegasus can also infect users through missed phone calls and  “zero-click” attacks, which do not require any action from the phone’s owner to succeed.

NSO Group says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals.

The company landed on the U.S. Commerce Department’s entity list in 2021 for activities counter to national security interests.

NSO has previously faced sanctions for refusing to comply with court orders ordering it to produce the Pegasus code in its entirety.

Meta’s lawsuit against NSO has seen more than half a decade of court proceedings that took the lawsuit through the Ninth Circuit, almost to the Supreme Court, and were almost “blown up” by their presiding judge mere weeks before the trial.