The phones of at least nine US State Department employees were hacked using Israeli firm NSO Group’s spyware, the Reuters news agency has reported, citing four unnamed sources familiar with the matter.
The hacking targeted the Apple-made iPhones of US officials based in Uganda or working on issues related to the country, Reuters reported on Friday.
The news agency said it could not determine who launched the cyberattacks.
The Washington Post confirmed Reuters reporting later on Friday, saying that Apple had informed 11 US officials that their phones were hacked.
The Israeli firm sparked outrage earlier this year after an investigation by international media outlets revealed that its Pegasus spyware was used by security forces and authoritarian governments against journalists and activists in several countries.
NSO says it works with law enforcement agencies to track criminals and “terrorists”.
But Apple filed a lawsuit against the Israeli company last month, accusing the company of using its Pegasus spyware to hack the devices of its users. Apple also released a patch to fix vulnerabilities exploited by the spyware.
NSO Group said in a statement to Reuters on Thursday that it did not have any indication its tools were used but cancelled the relevant accounts and would investigate based on the news agency’s inquiry.
“If our investigation shall show these actions indeed happened with NSO’s tools, such customer will be terminated permanently and legal actions will take place,” said an NSO spokesperson, adding that the firm would “cooperate with any relevant government authority and present the full information we will have”.
The news agency’s report comes after US President Joe Biden’s administration in early November imposed sanctions on NSO Group, among other firms, accusing it of enabling “transnational repression”.
In July, several Democratic Congress members called for an investigation into reports that US citizens, including diplomats and aid workers, were affected by NSO’s activity. The legislators urged the Biden administration to “determine whether America’s national security was harmed”.
NSO maintains that its hacking tools cannot target American phone numbers starting with the country code +1, but Apple noted in its legal complaint last month that US citizens’ phones, which “can and do cross international borders”, have been hacked.
The Israeli company is also facing a lawsuit from the instant messaging app, WhatsApp, which is owned by Meta, previously known as Facebook Inc.
A US appeals court ruled last month that WhatsApp can proceed with its 2019 lawsuit against NSO, dismissing the company’s effort to claim sovereign immunity because its clients are government agencies.
Officials at the Uganda embassy in Washington did not comment on the hacking, Reuters said. A spokesperson for Apple also declined to comment to the news agency, while a State Department spokesperson declined to comment on the intrusions, instead pointing to the November decision to blacklist the firm.