The Pegasus Project
A leaked list of about 50,000 numbers selected by NSO customers between 2016 and 2021. Selection is not proof of infection; forensic confirmation was possible only on a subset of phones.
The consortium
A July 2021 investigation led by Forbidden Stories with Amnesty International Security Lab and 17 media partners, including:
The list
A leaked list of about 50,000 numbers selected by NSO customers between 2016 and 2021. Selection is not proof of infection. Forensic confirmation was possible on a subset of phones.
Washington Post partners identified numbers belonging to more than 1,000 people, including 10 prime ministers, 3 presidents, and a king, plus at least 188 journalists.
Identified potential client countries
Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, UAE.
Heads of state whose numbers appeared
These are selections, not always forensic infections — label carefully.
Khashoggi circle
Hatice Cengiz, fiancée of Jamal Khashoggi, was forensically infected days after his murder. Wife Hanan Elatr and son Abdullah were also selected or targeted.
NSO's denial — and the 2026 contradiction
NSO said it saw no correlation between the leak and its systems, and that customers are contractually barred from targeting civil society.
Internal NSO systems (Sales 3, Sales 6 demo systems, employee test numbers) line up with clusters in the leak, contradicting the 2021 statement.
