Spyware Manufacturer NSO Group Retained Unchecked Access to Polish Pegasus Data, Transmitting Victim Information Abroad
What Happened — Polish investigators disclosed that the Central Anti‑Corruption Bureau (CBA) never held full administrative control over the Pegasus spyware operated by Israel‑based NSO Group. The vendor’s server module and privileged accounts remained under NSO’s exclusive control, allowing the company to modify software, retrieve harvested data, and transmit it through foreign anonymizing networks.
Why It Matters for Trust & Control Assurance
- This scenario exemplifies a failure of third‑party risk oversight: without documented, continuously‑monitored vendor privileges, an organization cannot prove due‑diligence or produce a defensible audit trail.
- Continuous control‑assurance programs require evidence that all external service providers are subject to strict access‑control policies, regular reviews, and real‑time monitoring—exactly the controls Verisq’s Vendor Risk Management capability helps capture.
- The lack of password access and visibility into the Pegasus module prevented the CBA from verifying data handling and storage, a gap that would be flagged by a robust vendor‑oversight control set.
Who Is Affected — Government agencies, law‑enforcement bodies, and any public‑sector entity that contracts surveillance or analytics vendors.
Recommended Actions
- Map the vendor‑access control gap to your organization’s third‑party risk control objectives and collect evidence of privileged‑account reviews.
- Implement continuous monitoring of vendor‑managed components, enforce least‑privilege policies, and require contractual clauses that grant your team full administrative access.
- Conduct an independent audit of all external surveillance or data‑collection tools to verify that no undisclosed back‑doors exist.
Source: The Record
Technical Notes
- Attack vector: third‑party dependency (NSO Group’s Pegasus platform).
- Data exfiltrated via anonymizing network using foreign IP addresses; no specific CVE cited.
- No evidence that NSO accessed individual inspection records, but technical capability existed.
Source: The Record