A recent court document has shed light on the extent of a 2019 hacking campaign that used NSO Group's notorious Pegasus spyware to target 1,223 WhatsApp users in 51 different countries. The document, published as part of a lawsuit filed by Meta-owned WhatsApp against NSO Group, reveals the scope of the surveillance operation, which exploited a vulnerability in the chat app to target hundreds of users, including more than 100 human rights activists, journalists, and "other members of civil society."

The country breakdown of the targeted users provides a rare insight into which NSO Group customers may be more active and where their victims and targets are located. Mexico tops the list with 456 individuals targeted, followed by India with 100, Bahrain with 82, Morocco with 69, Pakistan with 58, Indonesia with 54, and Israel with 51. There are also victims in Western countries, including Spain, the Netherlands, Hungary, France, the United Kingdom, and the United States.

Cybersecurity expert Runa Sandvik, who has been tracking victims of government spyware for years, notes that the true scale of the targeting is often missing from news articles. "What's often missing from these articles is the true scale of the targeting — the number of victims who were not notified; who did not get their devices checked; who opted not to share their story publicly. The list we see here — with 456 cases in Mexico alone, a country with documented, well-known civil society victims — speaks volumes about the true scale of the spyware problem," Sandvik told TechCrunch.

The hacking campaign, which occurred between April and May 2019, targeted more than a thousand WhatsApp users in just two months. This highlights the scale of the government spyware problem and raises concerns about the use of surveillance technology by governments around the world.

It's important to note that the presence of victims in a particular country does not necessarily mean that the government of that country was the customer using NSO Group's spyware. A government customer could be using Pegasus to target someone outside of their country. For example, Syria appears on the victim list, but NSO Group cannot export its technology to Syria due to international sanctions.

The number of victims also provides insight into who may be NSO Group's highest-paying customers. The company determines the price of its surveillance products based on the number of targets that can be concurrently infected with the spyware. Mexico, for instance, was reported to have spent more than $60 million on NSO Group's spyware, which could explain why there are so many Mexican targets on the list.

Last year, WhatsApp scored a historic victory when the judge presiding over the lawsuit ruled that NSO Group had breached U.S. hacking laws by targeting WhatsApp users. The next step in the lawsuit is an upcoming hearing that will determine the damages that the spyware maker will have to pay to WhatsApp.

The court case brought by WhatsApp has led to other revelations, including the fact that NSO Group disconnected 10 government customers after reports that they abused the spyware, and that the WhatsApp hacking tool produced by NSO Group cost up to $6.8 million for a one-year license, netting the company "at least $31 million in revenue in 2019."

WhatsApp spokesperson Zade Alsawah declined to comment on the matter, while NSO Group did not respond to a request for comment.

The revelations surrounding NSO Group's Pegasus spyware have significant implications for the global surveillance industry and raise important questions about the use of surveillance technology by governments around the world. As the lawsuit against NSO Group continues, it remains to be seen what further insights will be revealed about the scope and scale of government surveillance operations.