WhatsApp has said that Indian users were among those hit by the Pegasus surveillance attack and that the company reached out to the affected users this week. The development comes soon after the Facebook-owned chat service sued Israeli surveillance firm NSO Group on Tuesday, accusing it of helping government spies break into the phones of roughly 1,400 users across four continents in a hacking spree whose targets included diplomats, political dissidents, journalists and senior government officials.

The investigation by WhatsApp along with Canada-based Citizen Lab revealed that the attack targeted at least 100 human rights defenders, journalists and other members of civil society across the world.

A person familiar with the development at WhatsApp said that in India, the users impacted were a combination of regular users and members of civil society such as journalists and activists, but did not specify the number of people targeted.

WhatsApp said in a statement that the company "sent a special WhatsApp message to approximately 1,400 users that we have reason to believe were impacted by this attack to directly inform them about what happened."

"Indian users were among those contacted by us this week," WhatsApp said in a statement to CNBC-TV 18.

Electronics and information technology minister, Ravi Shankar Prasad tweeted that the government is concerned at the breach of privacy of citizens of India. He added that the government has asked Whatsapp to explain the breach and what it is doing to safeguard the privacy of millions of Indian citizens.

Government of India is concerned at the breach of privacy of citizens of India on the messaging platform Whatsapp. We have asked Whatsapp to explain the kind of breach and what it is doing to safeguard the privacy of millions of Indian citizens. 1/4 pic.twitter.com/YI9Fg1fWro

— Ravi Shankar Prasad (@rsprasad) October 31, 2019

In a blog post, Citizen Lab of University of Toronto said: "As part of our investigation into the incident, Citizen Lab has identified over 100 cases of abusive targeting of human rights defenders and journalists in at least 20 countries across the globe, ranging from Africa, Asia, Europe, the Middle East, and North America that took place after Novalpina Capital acquired NSO Group and began an ongoing public relations campaign to promote the narrative that the new ownership would curb abuses."

NSO Group, which also goes by the name Q Cyber Technologies, is an Israel-based company which develops and sells spyware technology. Novalpina is a European Private Equity firm, and has acquired majority stake in NSO Group.

According to Citizen Lab, NSO Group claims it sells its spyware strictly to government clients only.

The Pegasus spyware of the NSO Group can silently infiltrate both iOS and Android devices through a missed call, even if the call is not answered. An earlier version of the app required the targeted user to click on an ‘exploit link’, however, the latest iteration can work even on an unanswered call, making it significantly more discreet.

"Once Pegasus is installed, it begins contacting the operator’s command and control (C&C) servers to receive and execute operators’ commands, and send back the target’s private data, including passwords, contact lists, calendar events, text messages, and live voice calls from popular mobile messaging apps," Citizen Lab said in its post.

It continued: "The operator can even turn on the phone’s camera and microphone to capture activity in the phone’s vicinity, and use the GPS function to track a target’s location and movements."

WhatsApp has not shared details of the agencies that used the spyware to target users.

First Published:Oct 31, 2019 11:44 AM IST