Meta’s WhatsApp won a landmark judgment holding Israeli spyware maker NSO Group liable for hacking about 1,400 users through a WhatsApp zero-click exploit, and, more than the sharply reduced damages, a permanent injunction that threatens NSO’s core business.
LATEST DEVELOPMENT · JUN 8, 2026
On 29 June 2026, WhatsApp filed a reply brief in further support of its contempt motion against NSO Group, arguing that NSO’s opposition improperly relies on the very anonymizing infrastructure NSO built to obscure its conduct in order to dispute the link between it and the renewed targeting. The contempt motion remains pending before Judge Hamilton, and NSO’s Ninth Circuit appeal (No. 25-7380) of the underlying liability, damages and injunction also remains pending.
BACKGROUND
WhatsApp sued NSO Group in the Northern District of California in October 2019 under the federal Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act, after NSO’s Pegasus spyware exploited a WhatsApp vulnerability to target roughly 1,400 users, including journalists and activists. Judge Phyllis J. Hamilton found NSO liable on summary judgment in December 2024, and in May 2025 a jury awarded $444,719 in compensatory damages and about $167.25M in punitive damages.
In October 2025, Judge Hamilton reduced the punitive award to roughly $4M, about nine times the compensatory figure, in line with due-process limits, but entered a permanent injunction barring NSO from targeting WhatsApp, reverse-engineering the service or possessing its code. NSO appealed the liability finding, the damages and the injunction to the Ninth Circuit (No. 25-7380) and sought a stay. The injunction was not stayed, a coalition of civil-society groups filed amicus briefs in May 2026 urging the court to keep it, and in June 2026 WhatsApp moved to hold NSO in contempt over alleged continued targeting.
TIMELINE
-
JUN 29, 2026FILINGWhatsApp files reply brief in support of contempt motion against NSOWhatsApp filed a reply in further support of its motion to hold NSO Group in contempt, rebutting NSO’s opposition which argued WhatsApp had not adequately linked the alleged violative conduct to NSO. WhatsApp countered that NSO itself built the anonymizing infrastructure that creates this uncertainty.
-
JUN 8, 2026PROCEDURALWhatsApp files contempt motion over alleged renewed targetingWhatsApp asked the district court to hold NSO in contempt for allegedly continuing to target its users after the injunction.
-
MAY 2026PROCEDURALCivil-society groups file amici to preserve the injunctionAccess Now, the Knight Institute and others urged the Ninth Circuit to keep the injunction in place.
-
NOV 2025APPEALNSO appeals liability, damages and injunction to the Ninth CircuitNSO docketed an appeal (No. 25-7380) and sought to stay the permanent injunction pending review.
-
OCT 2025JUDGMENTPunitive damages cut to ~$4M. Permanent injunction enteredJudge Hamilton reduced the punitive award but barred NSO from ever targeting WhatsApp or possessing its code.
-
MAY 6, 2025AWARDJury awards $444,719 compensatory and $167.25M punitive damagesA California jury found NSO liable for damages over the hacking of roughly 1,400 WhatsApp users.
-
DEC 2024JUDGMENTCourt finds NSO liable on summary judgmentJudge Hamilton held NSO liable under the CFAA and California law for unauthorized access to WhatsApp’s systems.
-
OCT 29, 2019FILINGWhatsApp sues NSO Group over Pegasus exploitWhatsApp alleged NSO used a zero-click WhatsApp vulnerability to deliver Pegasus spyware to about 1,400 users.