Hackers for hire hit state department

WASHINGTON — The phones of 11 U.S. State Department employees were hacked with spyware from Israel’s NSO Group, the world’s most infamous hacker-for-hire company, a person familiar with the matter said Friday.

The employees were all located in Uganda and included some foreign service officers, said the person, who was not authorized to speak publicly about an ongoing investigation. Some local Ugandan employees of the department appear to have been among the 11 hacked, the person said.

The hacking is the first known instance of NSO Group’s trademark Pegasus spyware being used against U.S. government personnel.

It was not known what individual or entity used the NSO technology to hack into the accounts, or what information was sought.

“We have been acutely concerned that commercial spyware like NSO Group software poses a serious counterintelligence and security risk,” White House press secretary Jen Psaki said Friday.

Senior researcher John Scott-railton of Citizen Lab, the public-interest sleuths at the University of Toronto who have been tracking Pegasus infections for years, called the discovery a giant wake-up call for the U.S. government.

“For years we have seen that diplomats around the world are among targets,” he said, “and it looks like the message had to be brought home to the U.S. government in this very direct and unfortunate way.”

News of the hacks, first reported by Reuters, comes a month after the U.S. Commerce Department blacklisted NSO Group, barring U.S. technology from the company. And Apple sued NSO Group last week.