Polish prosecutors say Pegasus maker NSO could access data harvested by former government

Data harvested from phones by Polish authorities using the Pegasus spyware was sent outside Poland and was technically accessible to its Israeli maker, NSO Group, Poland's National Prosecutor's Office said on October 12, according to Notes from Poland and The Record. The findings, drawn from an analysis by the Internal Security Agency (ABW), concern the surveillance program run by the Central Anti-Corruption Bureau (CBA) under the previous Law and Justice (PiS) government, and they highlight a risk that governments buying commercial spyware may not fully control the data it collects.

What happened

According to The Record, prosecutors concluded that the CBA "did not have full control over the Pegasus system." The server module responsible for infecting mobile devices reportedly remained under the manufacturer's exclusive control, and the bureau lacked passwords for many administrator accounts, which prevented it from fully verifying how the system worked.

Notes from Poland reports that data travelled through servers in several countries over a network managed by NSO and outside the CBA's control. Prosecutors said NSO had technical access to surveillance materials and could make software and configuration changes through remote connections. However, investigators were unable to determine whether the company actually obtained material from specific operations.

Prime Minister Donald Tusk, who ordered the probe, called the case one of the biggest scandals in Polish history since the fall of communism and described it as a "crime against the state." He also said NSO cooperates with Israeli intelligence. NSO Group did not respond to The Record's request for comment.

Technical details

Forensic experts at the ABW confirmed that Pegasus could extract emails, messages, the content of phone and internet calls, browsing history, calendars, contacts, photos, videos and location data, Notes from Poland reports. The spyware could also switch on a phone's microphone and camera to record in real time and take screenshots.

A separate parliamentary committee released unclassified findings the same day. According to Notes from Poland, it found that the CBA never obtained the required IT security accreditation for the system, and that courts authorizing surveillance were allegedly not told that the tool could access a phone's entire contents.

Who is affected

The Record reports that more than 500 people were targeted, with some devices infected. According to both outlets, targets included opposition politicians, among them the head of the Civic Coalition's 2019 election campaign; Tusk has said his wife and daughter were also surveilled. Poland bought Pegasus in 2017.

PiS maintains that Pegasus was a necessary tool against crime and threats to national security and says it was used only with court approval against people legitimately suspected of wrongdoing.

What comes next

Tusk said the investigation is nearing its conclusion. Several former officials already face charges: according to Notes from Poland, prosecutors in February 2026 charged the former heads of the ABW and the Military Counterintelligence Service with abuse of power, and the former CBA head faces the same charge. All deny wrongdoing. Citizen Lab researcher John Scott-Railton told The Record that the findings show governments using such spyware face serious operational security risks of their own.