The European Union (EU) has found evidence that the phones used by some of its key employees were hacked by Israeli spyware, the bloc’s top justice official said in a letter seen by Reuters.
In a letter sent to EU lawmaker Sophie in’ t Veld, EU justice commissioner Didier Reynders said Apple told him in 2021 that his iPhone had potentially been hacked using Pegasus, a tool developed by the Israeli surveillance company NSO Group.
Apple’s warning triggered an inspection of Reynders’ personal and work devices, as well as other phones used by European Commission employees, the letter said.
Although the investigation did not find ‘conclusive evidence’ of a hack, investigators found ‘indicators of compromise’ – a term used by security experts to describe evidence that a hack took place .
The letter did not provide further details, with Reynders stating “it is impossible to attribute these indicators to a specific perpetrator with complete certainty”.
An investigation is currently underway in the EU.
This is not the first time that Europe’s highest echelons have been hacked. In April, Citizen Lab found that between 2020 and 2021, the UK Prime Minister’s office had been infected with Israeli spyware, along with at least 65 Catalan independence supporters in Spain.
Pegasus, which Citizen Lab calls “mercenary spyware”, has been used to break into the phones and computers of human rights activists, lawyers, journalists and church groups, although the group NSO claims that it only sells Pegasus to government agencies to target criminals and terrorists.
An NSO spokeswoman said the company would gladly cooperate with an EU investigation.
“Our assistance is even more critical, as there is so far no concrete evidence that a breach has taken place,” the spokeswoman said in a statement to Reuters. “Any illegal use by a customer targeting activists, journalists, etc., is considered serious abuse.”
EU officials have yet to comment on the alleged hack.
NSO Group is currently being sued by Apple for allegedly violating its Terms of Service and Services Agreement.
In April, Reuters reported that the EU was investigating whether phones used by Reynders and other senior European officials had been hacked using Israeli-made software.
Both parties declined to comment on the report at the time.
Reynders’ letter acknowledging the hacking activity was drafted in response to requests from European lawmakers, who earlier this year formed a committee to investigate the use of surveillance software in Europe.
Last week, the committee said it found that 14 EU member states had purchased NSO technology.
The letter – which was made public by in ‘t Veld – said Hungarian, Polish and Spanish officials had been or were being questioned about their use of Pegasus.
In ‘t Veld said it was important to find out who targeted the European Commission, suggesting it would be particularly outrageous if an EU member state was held responsible.
The European Commission has also raised the issue with the Israeli authorities, asking them to take action to “prevent the misuse of their products in the EU”, the letter says.
A spokesman for the Israeli Defense Ministry did not immediately respond to a request for comment.