Lupyd.
Advanced Security Messaging Security

WhatsApp Security Incidents, Spyware Attacks and Data Leaks: A Timeline from Pegasus to 2026

A timeline of WhatsApp's security incidents as of November 2026: NSO Group's Pegasus, Paragon's Graphite, the 2025 zero-click chain, fake apps, scraped phone numbers and regulatory fines. Encryption held; attacks hit phones, numbers and metadata.

S
Published: Nov 7, 2026
•
10 min read
On this page (13 sections)

WhatsApp has had more than a dozen notable security incidents and actions since 2019, and the biggest was the 2019 NSO Group attack, which used a voice-call bug to plant Pegasus spyware on about 1,400 phones. No incident has shown WhatsApp's end-to-end encryption being broken or message content leaking from WhatsApp's servers. The damage came from spyware on endpoints, scraped or enumerated phone numbers, and regulators' findings about how data was shared.

WhatsApp Security Incident Timeline

The table lists incidents in date order, with the vendor's own description of what was and wasn't exposed where one exists. It is current as of 7 November 2026.

Notable WhatsApp security incidents, spyware attacks and regulatory actions, 2019 to November 2026
Date Incident What was exposed Type
May 2019 NSO Group's Pegasus delivered through a WhatsApp voice call bug (CVE-2019-3568) Full access to about 1,400 targeted phones, per WhatsApp's lawsuit; messages readable on infected devices Exploited vulnerability (spyware)
Jan 2021 Privacy policy update on data sharing with Facebook; enforcement delayed after backlash No exposure; dispute over account and business-messaging data shared with Facebook Policy controversy
Sep 2021 Irish Data Protection Commission fines WhatsApp €225 million No exposure; GDPR transparency failures toward users and non-users Regulatory action
Nov 2022 Seller claims 487 million WhatsApp phone numbers for sale Phone numbers, likely scraped; WhatsApp denied a leak from its systems Scraped data claim
Nov 2024 Competition Commission of India fines Meta ₹213.14 crore over the 2021 policy No exposure; abuse of dominance over data sharing (later partly set aside on appeal) Regulatory action
Jan 2025 Paragon Solutions' Graphite spyware campaign disrupted About 90 accounts targeted, some phones infected, per WhatsApp and Citizen Lab Exploited vulnerability (spyware)
Apr 2025 WhatsApp for Windows attachment spoofing bug (CVE-2025-30401) None known; WhatsApp saw no exploitation Vulnerability
May 2025 US jury orders NSO to pay WhatsApp about $167.7 million Court ruling on the 2019 attacks Court ruling
Aug 2025 Linked-device sync bug (CVE-2025-55177) chained with Apple's CVE-2025-43300 Fewer than 200 targeted users notified; device compromise on iPhone and Mac Exploited vulnerability (spyware)
Oct 2025 Permanent injunction bars NSO from targeting WhatsApp; damages cut to about $4 million Court ruling Court ruling
Nov 2025 University of Vienna and SBA Research enumerate 3.5 billion accounts via contact discovery Which numbers have accounts, plus public profile photos and About text; no messages Vulnerability (enumeration)
Jan 2026 Google Project Zero reports zero-click media delivery through Android group chats None reported; no known exploitation Vulnerability
Apr 2026 Fake iOS WhatsApp app from Italian spyware maker SIO About 200 users, mainly in Italy, who installed the fake app Spyware (fake app)
Jun 2026 NSO-linked spear phishing links disrupted; WhatsApp seeks contempt Users sent malicious links; the court denied contempt in October 2026 Phishing (spyware)

Sources: WhatsApp Security Advisories, court reporting by The Record and SecurityWeek, Citizen Lab, the Irish DPC and TechCrunch. Full list under Sources & References.

2019: NSO Group's Pegasus Call Exploit and the Lawsuit

What happened. In May 2019 WhatsApp fixed CVE-2019-3568, which its advisory describes as "a buffer overflow vulnerability in WhatsApp VOIP stack" that allowed remote code execution through specially crafted RTCP packets sent to a target's phone number. Attackers used it to install NSO Group's Pegasus spyware. Citizen Lab, which helped investigate, said the exploit worked "simply by ringing the number of a target's device." The target didn't need to answer.

What was exposed. WhatsApp's October 2019 lawsuit said NSO used WhatsApp's servers to send malware to about 1,400 devices. Citizen Lab said it found over 100 cases of abusive targeting of human rights defenders and journalists in at least 20 countries. Pegasus takes control of the phone, so messages could be read on infected devices after WhatsApp decrypted them. The encryption itself wasn't broken.

The court case. WhatsApp and Facebook sued NSO and its parent Q Cyber Technologies in federal court in California on 29 October 2019. In December 2024 Judge Phyllis Hamilton ruled for WhatsApp on liability under US and California anti-hacking laws. On 6 May 2025 a jury awarded WhatsApp $444,719 in compensatory damages and $167,254,000 in punitive damages. On 17 October 2025 the judge cut the punitive award to just over $4 million but granted a permanent injunction barring NSO from targeting WhatsApp, reverse engineering it or creating WhatsApp accounts, and ordering it to delete any WhatsApp source code it holds. NSO has appealed to the Ninth Circuit.

2025: Paragon's Graphite Spyware

On 31 January 2025 WhatsApp said it had disrupted a spyware campaign by Paragon Solutions, an Israeli-founded company, and notified about 90 users, including journalists and members of civil society. WhatsApp sent Paragon a cease-and-desist letter. A WhatsApp spokesperson said: "This is the latest example of why spyware companies must be held accountable for their unlawful actions."

Citizen Lab's March 2025 report, Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations, said WhatsApp "discovered and mitigated an active Paragon zero-click exploit" and found forensic traces of Paragon's Graphite on the phones of two people in Italy. Reporting described the delivery as adding targets to a WhatsApp group and sending a malicious PDF. WhatsApp told BleepingComputer it fixed the flaw late in 2024 without a client-side update and did not assign a CVE.

2025: The Linked-Device Zero-Click Chain on iPhone and Mac

In August 2025 WhatsApp disclosed CVE-2025-55177 in its iOS and Mac apps: "incomplete authorization of linked device synchronization messages" that could let an unrelated user make a target's device process content from an arbitrary URL. WhatsApp said the bug, combined with an Apple ImageIO flaw (CVE-2025-43300) that Apple had patched a week earlier, "may have been exploited in a sophisticated attack against specific targeted users."

Meta told TechCrunch it sent fewer than 200 notifications to users who may have been targeted. Amnesty International's Security Lab described an advanced spyware campaign running since the end of May 2025. Meta did not name the attacker. Both patches were needed: the WhatsApp app fix and the Apple operating system update.

2026: A Fake App, Phishing Links and NSO Again

SIO's fake iOS WhatsApp app (April 2026)

On 1 April 2026 WhatsApp said its security team "proactively identified around 200 users primarily in Italy" who may have installed a fake iOS version of WhatsApp that was actually spyware. WhatsApp attributed it to Italian spyware maker SIO, which builds government spyware through its subsidiary ASIGINT. WhatsApp logged the affected users out, told them to delete the fake app and install the official one, and said it would send SIO a legal demand. This was not a flaw in WhatsApp's encryption: the victims were running a malicious app instead of WhatsApp.

NSO-linked phishing and the contempt motion (June to October 2026)

On 8 June 2026 WhatsApp said it had "caught and disrupted spear phishing attempts linked to NSO" after user reports. The attackers "tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp," and WhatsApp said it also took down test accounts and groups NSO had created. WhatsApp asked the court to hold NSO in contempt of the injunction. On 16 October 2026 Judge Hamilton denied the motion, finding WhatsApp had not shown a violation by clear and convincing evidence. WhatsApp had relied on one investigator's declaration about 23 new accounts and declined to explain its detection methods.

Phone Numbers: The 2022 Sale Claim and the 3.5 Billion Enumeration

The 487 million number claim (November 2022)

In November 2022 Cybernews reported a hacking-forum post offering what the seller said were 487 million WhatsApp users' phone numbers. Cybernews checked a sample and found the numbers belonged to WhatsApp users, and suggested the list was likely scraped. As reported, this was scraping, not a breach of WhatsApp's systems. A WhatsApp spokesperson said the claim was based on "unsubstantiated screenshots" and that there was "no evidence of a 'data leak' from WhatsApp." Regulators in Ireland and Hong Kong contacted Meta about the reports.

Contact discovery enumeration (disclosed November 2025)

Researchers from the University of Vienna and SBA Research showed they could query WhatsApp's contact discovery at more than 100 million phone numbers per hour and confirmed over 3.5 billion active accounts in 245 countries. Their paper, presented at NDSS 2026, also collected public profile photos and About text where users had left them visible to everyone, plus timestamps and public keys used to infer details such as the number of linked devices.

WhatsApp's VP of Engineering Nitin Gupta said the study "surpassed our intended limits" to scrape "basic publicly available information," that the researchers deleted the data, and that WhatsApp found "no evidence of malicious actors abusing this vector." Meta said messages and contacts were not exposed and that it was inaccurate to say 3.5 billion numbers were "exposed" or "obtained," since the researchers generated candidate numbers and checked which were registered. Meta says it received full technical details in August 2025 and added stricter rate limits in September and October 2025.

Regulators: The €225 Million GDPR Fine and India's 2021 Policy Case

Ireland, 2021. On 2 September 2021 the Irish Data Protection Commission fined WhatsApp Ireland €225 million after an inquiry, opened in December 2018, into whether WhatsApp gave users and non-users transparent information about its processing, including data shared with other Facebook companies. The DPC also issued a reprimand and ordered WhatsApp to bring its processing into compliance. WhatsApp said it disagreed and would appeal. No data was exposed; this was about disclosure.

India, 2021 to 2026. In January 2021 WhatsApp's updated privacy policy, which set out data sharing with Facebook, drew a large backlash, and WhatsApp moved enforcement from 8 February to 15 May 2021, saying the update did not affect personal messages. On 18 November 2024 the Competition Commission of India fined Meta ₹213.14 crore and barred WhatsApp from sharing user data with Meta for advertising for five years. On 4 November 2025 the NCLAT upheld the penalty but set aside the five-year ban. Meta and WhatsApp have taken the case to the Supreme Court of India, which heard it in February 2026. For the separate fight over traceability, see WhatsApp, India and encryption traceability in 2026.

Bugs Fixed Without Known Exploitation

WhatsApp's advisories list several bugs it says were not exploited in the wild, including CVE-2025-30401 (April 2025, WhatsApp for Windows showed attachments by type but opened them by file extension), CVE-2025-55179 (November 2025, rich response messages on iOS and Mac), and two 2026 advisories, CVE-2026-23863 (attachment spoofing on Windows) and CVE-2026-23866 (AI rich responses on iOS and Android). In January 2026 Google Project Zero reported that WhatsApp for Android could auto-download attacker-controlled media sent to a newly created group; Malwarebytes reported that Meta made a server-side change in November 2025 that Google said only partly fixed the issue. No exploitation has been reported.

What the Incidents Have in Common

  • The endpoint, not the encryption. Pegasus, Graphite and the 2025 chain all compromised the phone itself. Once spyware runs on a device, it reads messages after the app decrypts them. End-to-end encryption did its job between devices and could not help here.
  • WhatsApp's own features as the delivery route. A voice call, a group plus a PDF, and linked-device sync messages: the 2019 to 2025 exploits all abused code that processes content from strangers before the user does anything. That is why WhatsApp's 2026 Strict Account Settings blocks media from unknown senders.
  • The phone number as identity. The 2022 list and the 2025 enumeration both turned on the phone number being a public lookup key. End-to-end encryption protects message content; it does not hide whether a number has an account, or a profile photo set to "Everyone".
  • Social engineering. The 2026 SIO fake app and the NSO phishing links needed the target to install or click something. No messaging protocol prevents that.
  • Metadata and data sharing. The Irish and Indian cases were about what WhatsApp told users and shared with Meta, not message content. End-to-end encryption doesn't cover metadata.

For a broader look at what WhatsApp can and can't see, read is WhatsApp safe for business communication.

How to Protect WhatsApp Accounts

  1. Update WhatsApp and the phone's operating system quickly. The 2025 attack needed both the WhatsApp fix and Apple's patch to be closed.
  2. Turn on two-step verification in Settings, Account, so a stolen SMS code alone can't move your account. See our two-factor authentication guide.
  3. Check Linked Devices regularly and log out any session you don't recognise.
  4. Use Strict Account Settings if you may be targeted. WhatsApp launched it on 27 January 2026 for people such as journalists and public figures; it blocks attachments and media from people not in your contacts. Find it under Settings, Privacy, Advanced. On an iPhone, Apple's Lockdown Mode adds protection at the OS level.
  5. Install WhatsApp only from the App Store or Google Play, and treat links from unknown or unexpected senders with suspicion, even inside WhatsApp.
  6. Limit what strangers can see: set profile photo, About and last seen to My contacts, and turn on Silence unknown callers.
  7. Turn on end-to-end encrypted backups so cloud backups are not stored in a form your cloud provider can read.
  8. Take WhatsApp's threat notifications seriously. If you get one, follow its guidance and contact a digital security helpline before using the phone for sensitive work.

Frequently Asked Questions

Has WhatsApp ever been hacked?

WhatsApp users have been hacked through WhatsApp bugs, most notably by NSO Group's Pegasus in 2019, Paragon's Graphite in late 2024 and an unattributed campaign in 2025. There is no public report of a breach of WhatsApp's servers that exposed message content.

Did Pegasus break WhatsApp's end-to-end encryption?

No. Pegasus used a bug in WhatsApp's calling code to take over the phone. Once installed, spyware can read messages on the device after WhatsApp decrypts them, so encryption between devices was never the weak point.

Was there a WhatsApp data breach of 487 million phone numbers?

Not a breach as reported. In November 2022 a seller offered 487 million numbers said to belong to WhatsApp users, and Cybernews suggested they were likely scraped. WhatsApp said there was no evidence of a data leak from WhatsApp.

Were 3.5 billion WhatsApp accounts leaked in 2025?

No messages leaked. University of Vienna researchers used WhatsApp's contact discovery to confirm over 3.5 billion active accounts and collect public profile details. Meta said messages and contacts were not exposed, the researchers deleted the data, and it added stricter rate limits.

What is WhatsApp Strict Account Settings?

A lockdown-style mode WhatsApp launched in January 2026 for people who may face sophisticated attacks, such as journalists and public figures. It locks account settings to their strictest values and blocks attachments and media from people not in your contacts. Turn it on under Settings, Privacy, Advanced.

Final Takeaway

WhatsApp's record shows end-to-end encryption holding while attackers went around it: spyware on phones, bugs in features that process content from strangers, fake apps, phishing links, and phone numbers that work as a public directory. Keep the app and OS updated, lock down the account, and assume metadata and your number are visible even when messages aren't. Every messaging app, including ours, faces the same endpoint and phishing risks. Lupyd uses the Signal Protocol for DMs and MLS for group channels, but it is a young product with far fewer users and no external security audit yet, and our group calls are not yet end-to-end encrypted. Compare options in which messaging apps are end-to-end encrypted, or Try Lupyd.

Sources & References

Last updated: 7 November 2026.

Key Takeaways
  • ✓ No public incident has shown WhatsApp's end-to-end encryption being broken or message content leaking from its servers; attacks targeted phones, phone numbers and metadata.
  • ✓ The biggest incident was NSO Group's 2019 Pegasus attack via a WhatsApp voice-call bug (CVE-2019-3568) on about 1,400 devices; a jury awarded WhatsApp about $167.7 million in 2025, later cut to about $4 million in punitive damages with a permanent injunction.
  • ✓ Paragon's Graphite targeted about 90 users in late 2024, and a 2025 linked-device bug chained with an Apple flaw led WhatsApp to notify fewer than 200 users; in 2026 WhatsApp caught a fake iOS app and NSO-linked phishing links.
  • ✓ The 2022 claim of 487 million numbers for sale was reported as scraping, not a breach, and the 2025 University of Vienna study enumerated 3.5 billion accounts through contact discovery before Meta tightened rate limits.
  • ✓ Update WhatsApp and your OS promptly, turn on two-step verification, check Linked Devices, and use Strict Account Settings if you may be targeted.
Try Lupyd

The workspace where nothing leaks

End-to-end encrypted channels and chat for your team, built on the Signal Protocol and MLS. Available on macOS, Windows, Linux and Android.

Download Lupyd See features
Continue Reading

Related Articles

Open Source

Explore Lupyd on GitHub

Inspect our open-source repositories, cryptography libraries, and client tools on GitHub.

Explore Lupyd on GitHub