AP Source: NSO Group spyware used to hack State employees

WASHINGTON » The phones of 11 U.S. State Department employees were hacked using technology from Israel’s NSO Group, the world’s most infamous hacker-for-hire company, a person familiar with the matter said Friday.

The employees were all located in Uganda and included some foreign service officers, said the person, who was not authorized to speak publicly about an ongoing investigation. Some local Ugandan employees of the department appear to have been among the 11 hacked, the person said.

The hacking is the first known instance of NSO Group’s spyware, known as Pegasus, being used against U.S. government personnel.

It was not known what individual or entity used the NSO technology to hack into the accounts, or what information was sought.

“We have been acutely concerned that commercial spyware like NSO Group software poses a serious counterintelligence and security risk to U.S. personnel,” White House press secretary Jen Psaki said at briefing Friday.

News of the hacks, which were first reported by Reuters, comes a month after the U.S. Commerce Department blacklisted NSO Group, barring U.S. technology from being used by the company. And Apple sued NSO Group last week seeking to effectively shut down its hacking of all iPhones and other Apple products, calling the Israeli company “amoral 21st century mercenaries.”

The State Department employees were hacked on their iPhones, the person familiar with the matter said.

NSO Group said in a statement that it had terminated the “relevant customers’ access” to its hacking system, but did not say who the customers were. The company said its spying technology is blocked from hacking phones based in the U.S. and only sells to licensed customers.

“NSO has no way to know who the targets of the customers are, as such, we were not and could not have been aware of this case,” the company said.

In announcing the lawsuit, Apple sent out notifications globally to people whose iPhones were hacked with Pegasus in countries ranging from El Salvador to Poland. The targeted State Department employees were among them.