Full Report
Data harvested from mobile phones by the Polish authorities using Pegasus spyware were transmitted outside Poland and were accessible to the tool’s Israeli producer, Polish prosecutors have revealed as part of an investigation into the use of Pegasus under the former government. Prime Minister Donald Tusk says that the case is “one of the biggest […]
Analysis Summary
# Incident Report: Unauthorized Third-Party Access to Polish Pegasus Surveillance Data
## Executive Summary
An investigation by Polish prosecutors has revealed that data harvested from mobile phones by Polish authorities using Pegasus spyware was transmitted outside of Poland's jurisdiction. The investigation confirmed that the tool’s producer, the Israeli-based NSO Group, had technical access to the exfiltrated data, creating a significant national security breach and privacy scandal. Prime Minister Donald Tusk has characterized the incident as one of the largest scandals in the country's post-communist history.
## Incident Details
- **Discovery Date:** Investigation findings revealed October 12, 2026
- **Incident Date:** 2017 – Late 2023 (Active period under the previous government)
- **Affected Organization:** Government of Poland (specifically opposition figures and citizens targeted by security services)
- **Sector:** Government / National Security
- **Geography:** Poland / Israel
## Timeline of Events
### Initial Access
- **Date/Time:** Commencing in 2017.
- **Vector:** Deployment of Pegasus spyware via zero-click exploits or malicious links.
- **Details:** Polish security services utilized the NSO Group's software to infect mobile devices of targeted individuals, including opposition figures.
### Lateral Movement
- **Details:** Not applicable in the traditional network sense; the spyware operated by gaining full remote access to individual mobile device operating systems (iOS/Android).
### Data Exfiltration/Impact
- **Details:** Harvested data (messages, photos, microphone/camera feeds, and location data) was transmitted to servers outside Poland. Prosecutors confirmed that NSO Group employees/infrastructure had access to this data during or after the Polish authorities' collection process.
### Detection & Response
- **How it was discovered:** Following a change in government, a formal prosecutorial investigation and a parliamentary commission of inquiry were launched into the "Pegasus Affair."
- **Response actions taken:** Official announcement of findings by prosecutors; public condemnation by the Prime Minister; ongoing legal proceedings against former government officials.
## Attack Methodology
- **Initial Access:** Zero-click exploits (no user interaction required) or "one-click" spear-phishing.
- **Persistence:** Spyware resides on the mobile device, though it often requires re-infection if the device is rebooted (depending on the version).
- **Privilege Escalation:** Exploitation of unknown vulnerabilities (Zero-days) to gain root/kernel-level access to mobile devices.
- **Defense Evasion:** Encrypted communications and self-destruct mechanisms to hide the presence of the agent.
- **Credential Access:** Extraction of passwords and tokens from the device's keychain and memory.
- **Collection:** Gathering of SMS, encrypted chat logs (WhatsApp/Signal), emails, photos, and live environmental recording.
- **Exfiltration:** Data sent via encrypted channels to NSO-controlled or leased infrastructure.
- **Impact:** Massive breach of privacy and potential compromise of state secrets to a foreign private entity (NSO Group) and, by extension, foreign intelligence.
## Impact Assessment
- **Financial:** Multi-million dollar licensing fees paid from a justice fund; potential legal settlements for victims.
- **Data Breach:** High-volume exfiltration of sensitive personal and political data.
- **Operational:** Systematic compromise of the integrity of Polish security service operations.
- **Reputational:** Severe loss of public trust in state institutions; international scrutiny regarding democratic backsliding.
## Indicators of Compromise
- **Network indicators:** Communications with known NSO C2 infrastructure (e.g., [.]verizon-edge[.]com - *Note: Generic examples of Pegasus infrastructure*).
- **Behavioral indicators:** Unusual battery drain on mobile devices; unexpected data usage spikes; process anomalies in mobile OS logs.
## Response Actions
- **Containment:** Suspension of Pegasus use by the current administration.
- **Eradication:** Decommissioning of the hardware/software suites used to manage the spyware.
- **Recovery:** Establishing a parliamentary commission to identify victims and provide legal recourse.
## Lessons Learned
- **Sovereignty Risks:** Utilizing "Spyware-as-a-Service" from foreign commercial entities introduces the risk that the vendor (or their host nation) retains access to the harvested intelligence.
- **Oversight Failures:** The lack of judicial and parliamentary oversight allowed for the weaponization of surveillance tools against political opponents.
- **Infrastructure Transparency:** Data residency is critical; state secrets should never be processed through third-party foreign servers.
## Recommendations
- **Sovereign Capability:** Develop or utilize only those surveillance tools where the host nation retains 100% control over the data pipeline.
- **Strict Oversight:** Implement mandatory judicial approval and independent technical auditing for any use of "intrusive" surveillance technology.
- **End-Point Protection:** Deploy mobile threat defense (MTD) solutions for high-risk government personnel to detect indicators of advanced spyware.