WhatsApp Lawsuit: The NSO Group Pegasus Case, Explained
When people search "WhatsApp lawsuit," they're almost always looking for one case: WhatsApp Inc. v. NSO Group Technologies, the six-year fight over NSO's Pegasus spyware. In 2019, NSO exploited a bug in WhatsApp's calling feature to install Pegasus on roughly 1,400 phones belonging to journalists, human rights activists, diplomats, and government officials — not random consumers. A jury awarded WhatsApp's parent company Meta $167.7 million in May 2025; a judge cut that to about $4 million in October 2025 while permanently barring NSO from targeting WhatsApp again. In June 2026, WhatsApp accused NSO of breaking that order with new attacks. There is no class-action settlement here and never has been — if you're a regular WhatsApp user, this lawsuit does not owe you money.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened: The Pegasus Spyware Hack
In April and May 2019, NSO Group — an Israeli surveillance technology company — exploited a vulnerability in WhatsApp's voice-calling feature (later catalogued as CVE-2019-3568) to remotely install its Pegasus spyware on roughly 1,400 phones, without the owner ever answering the call. The targets were not a broad slice of WhatsApp's user base: court records identify more than 100 human rights defenders, journalists, civil society members, government officials, and diplomats across multiple countries. WhatsApp's parent company, Meta, sued NSO Group and its affiliate Q Cyber Technologies on October 29, 2019, alleging violations of the federal Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act, and WhatsApp's own Terms of Service. NSO admitted building the exploit but argued it only sold the tool to government clients and wasn't responsible for how they used it.
Case Details
WhatsApp Inc. and Meta Platforms, Inc. v. NSO Group Technologies Ltd. and Q Cyber Technologies Ltd., Case No. 19-cv-07123, U.S. District Court for the Northern District of California, Oakland Division, before Judge Phyllis J. Hamilton. This is not a class action — it has no claims administrator, no official claim website, and no claimant hotline. It is a civil lawsuit brought directly by WhatsApp/Meta against NSO Group, and any money awarded goes to Meta, not to individual users.
Current Status: Judgment Cut to $4M, Now a Contempt Fight
Can You File a Claim? No — Here's Why
There is no claims process to join, no deadline to meet, and no form to fill out — because this was never a consumer class action. WhatsApp and Meta sued NSO Group directly, as the injured company, over damage to their own platform and to roughly 1,400 specifically identified individuals whose phones were hacked. Those ~1,400 people were evidence in the case, not a certified class the public can opt into. If you're an ordinary WhatsApp user who wasn't one of the specific 2019 targets — and virtually everyone searching this term is not — you are not eligible for any part of this judgment, and there has never been a way to apply for one. If you believe your own phone was specifically targeted by Pegasus around 2019, the nonprofit forensic lab Citizen Lab and Meta's own in-app security notifications are the places to start, not a claims form.
Where Does the $4 Million Actually Go?
Timeline: From the 2019 Hack to the 2026 Contempt Fight
- 1
April–May 2019 — Pegasus exploit deployed
NSO Group exploits a WhatsApp voice-call vulnerability (CVE-2019-3568) to silently install Pegasus spyware on roughly 1,400 phones belonging to journalists, human rights defenders, and diplomats.
- 2
October 29, 2019 — WhatsApp and Meta sue NSO Group
WhatsApp files suit in the Northern District of California, alleging NSO violated federal and California hacking laws and breached WhatsApp's Terms of Service. NSO's bids to dismiss the case on sovereign-immunity grounds fail through 2020–2023, including a rejected Supreme Court appeal.
- 3
December 2024 — Judge rules NSO liable
Judge Hamilton grants partial summary judgment, finding NSO liable under the Computer Fraud and Abuse Act, California's CDAFA, and for breach of contract — leaving only the amount of damages for a jury to decide.
- 4
May 6, 2025 — Jury awards $167.7 million
After a two-week trial, a jury awards WhatsApp/Meta $444,719 in compensatory damages and $167,254,000 in punitive damages — a combined $167.7 million, among the largest verdicts ever against a spyware maker.
- 5
June 2, 2025 — NSO seeks a new trial
NSO asks the court for a new trial or a reduction of the award, calling the punitive damages "unconstitutionally excessive" and beyond its ability to pay.
- 6
October 17, 2025 — Damages cut to $4M, permanent injunction issued
Judge Hamilton grants partial remittitur, reducing the total judgment to about $4 million, and simultaneously issues a permanent injunction barring NSO from ever targeting WhatsApp or its users again.
- 7
June 8, 2026 — WhatsApp alleges NSO broke the injunction
WhatsApp says it disrupted a new NSO-linked spear-phishing campaign and asks the court to hold NSO in contempt for violating the October 2025 order — a motion still pending as of August 2026.
Scam Alert: Fake "WhatsApp Lawsuit" Payout Messages
Because this case generated headlines like "$167 million WhatsApp verdict," it has become a template for scammers who bank on people confusing a corporate lawsuit with a class-action settlement they can cash in on. Three patterns to watch for:
"You're eligible for a WhatsApp lawsuit payout" texts
Scam texts, messages, and emails claim you're owed a share of "the WhatsApp settlement" and ask you to click a link or hand over personal or bank details to "claim" it. There is no such settlement — the real case has no claims process for the public at all. Delete these messages and never click the link.
Fake "official" claim sites
Because there's no real claims portal for this case, any webpage calling itself the "official WhatsApp lawsuit claim site" is fabricated. If a site asks for your Social Security number, bank login, or a "processing fee" to release a WhatsApp lawsuit payment, it's fraud — report it at ReportFraud.ftc.gov.
Fake spyware "warnings" that install real spyware
Some of the phishing WhatsApp flagged in June 2026 used messages about spyware and hacking to lure people into clicking malicious links off the app — the same social-engineering trick scammers now apply to this lawsuit's own news coverage. Don't click links in unsolicited messages about "checking if you were hacked" or "claiming compensation," even if they reference this real case by name.
WhatsApp Lawsuit FAQ
Is there a WhatsApp lawsuit settlement I can file a claim for?
No. WhatsApp Inc. v. NSO Group is a corporate lawsuit, not a consumer class action. There is no claims process, no deadline, and no payout for the general public — regardless of what a text message or website tells you.
What was the WhatsApp lawsuit actually about?
NSO Group, maker of the Pegasus spyware, exploited a bug in WhatsApp's calling feature in 2019 to hack roughly 1,400 phones belonging to journalists, activists, and diplomats. WhatsApp and Meta sued NSO for violating hacking laws and its Terms of Service — and won.
How much did NSO Group actually have to pay?
A jury initially awarded $167.7 million in May 2025, but Judge Hamilton reduced that to about $4 million in October 2025, ruling NSO's conduct didn't meet the bar for the larger punitive award. That $4 million goes to Meta, not to WhatsApp users.
Is the WhatsApp lawsuit still active in August 2026?
Yes. WhatsApp filed a motion in June 2026 asking the court to hold NSO Group in contempt for allegedly violating the permanent injunction with new spyware-linked phishing attacks, and that motion is still pending.
Was I one of the people targeted by Pegasus?
Almost certainly not, unless you're a journalist, human rights defender, diplomat, or government official who was specifically targeted around 2019 — court records put the total at about 1,400 people worldwide. If you suspect you were targeted, the nonprofit Citizen Lab at the University of Toronto offers device-forensics guidance, and Meta has separately notified confirmed targets directly.
Does the permanent injunction mean NSO can no longer target WhatsApp users?
That's the intent of the October 2025 order, but WhatsApp alleges NSO violated it within months — the company reported catching new NSO-linked phishing attempts in June 2026 and is asking the court to enforce the ban through contempt sanctions.
How do I protect myself from spyware like Pegasus?
Keep your phone's operating system and WhatsApp fully updated (Pegasus relies on unpatched vulnerabilities), never click links in unexpected messages, and consider enabling Lockdown Mode (iPhone) if you're in a high-risk profession. WhatsApp and Apple both send direct in-app notifications to users they've confirmed were targeted by state-sponsored spyware — that's the only legitimate "you were targeted" alert you'll ever get.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.