WhatsApp has won a major legal victory against Israeli cyberintelligence firm NSO Group. A federal judge granted a permanent injunction that bars NSO from targeting WhatsApp and its global user base, marking a decisive end to years of litigation over a 2019 spyware campaign.
The injunction comes alongside a dramatic change in financial penalties. Earlier this year, a jury ordered NSO Group to pay more than $167 million to Meta, WhatsApp’s parent company, over an operation that allegedly targeted more than 1,400 users, including journalists and human rights defenders. But U.S. District Judge Phyllis Hamilton has now reduced the payment to roughly $4 million, finding there wasn’t enough evidence to deem NSO’s conduct “particularly egregious.” As a result, the court capped punitive damages at a 9-to-1 ratio.
Will Cathcart, head of WhatsApp, welcomed the decision, saying it bans the spyware maker from ever targeting the platform’s users again. He praised the ruling as a milestone after six years of legal efforts to hold NSO accountable for attacking members of civil society.
The case stems from a 2019 campaign that drew international scrutiny for its scope and the high-profile nature of its targets. The permanent injunction is likely to be seen as a strong deterrent against future attempts to compromise WhatsApp’s security or surveil its users through similar tools.
While the damages award was significantly reduced, the ban itself is a substantial win for user privacy and platform security. It underscores the court’s willingness to restrict the activities of companies accused of using spyware to infiltrate widely used communications services.
Adding another twist, NSO Group recently confirmed that it is being acquired by U.S. investors. How that transition affects the company’s operations remains to be seen, but the injunction ensures WhatsApp users are legally shielded from NSO’s targeting going forward.
For millions of people who rely on WhatsApp for secure communication, this ruling reinforces the platform’s stance on privacy and delivers a clear message to would-be attackers: court orders can and will be used to protect users worldwide.
