-
Polish prosecutors say data from the Pegasus spyware left Poland. Its Israeli maker, NSO Group, could reach it.
-
Investigators say Poland’s Central Anti-Corruption Bureau (CBA) did not fully control the system. That raises worries about how safe the surveillance data was.
-
Prime Minister Donald Tusk said the affair was a crime against the state. Prosecutors did not confirm that NSO opened data from specific surveillance cases.
Polish prosecutors have raised new concerns about the country’s use of Pegasus spyware. They say the system sent surveillance data outside Poland. They also say its Israeli maker, NSO Group, had technical access to the collected material. Reports say the findings came out on October 12, 2026.
The findings are part of a probe into how Poland’s former Law and Justice (PiS) government used Pegasus. According to the National Prosecutor’s Office, experts from the Internal Security Agency (ABW) studied the system. They checked what it could do. They also checked how it handled information from targeted phones.
Prime Minister Donald Tusk called the revelations one of the biggest scandals in Poland since communism fell. He also described the affair as a crime committed against the state. Tusk argued that officials paid for a spying tool they could not properly control.
The probe has clear limits, though. Investigators have not proven that NSO Group took material from specific surveillance cases. Prosecutors confirmed the company’s technical access. They did not say whether it opened any particular records.
Pegasus Could Pull Huge Amounts of Data From Phones
Poland bought Pegasus from NSO Group in 2017. The PiS government was in power at the time. Later, people accused officials of using the spyware against political opponents and other people. Those claims led to investigations after Tusk’s coalition took power in December 2023.
The ABW experts listed what Pegasus could collect. It could take emails, text messages, and chat messages. It could record calls and copy browsing histories. Contacts, calendars, photos, videos, and files were also within reach. So was location information.
The National Prosecutor’s Office said the spyware could switch on a phone’s microphone and cameras. That let it capture sound and video as events happened. It could also take screenshots. This reach goes far beyond simple call records or message details. For that reason, control over the system matters a lot. The way officials store the collected data matters just as much.
NSO Group Kept Control Over Key Parts of the System
Investigators found gaps in Poland’s control over the spyware. The CBA ran the system. Yet it lacked passwords for some accounts with admin rights. Meanwhile, NSO Group kept control over certain parts. Prosecutors pointed to one part in particular. The server module that infects mobile phones stayed under the maker’s sole control.
Experts also found that data travelled through servers in different parts of the world. NSO Group managed the network that carried it. The CBA had no control over that route. This raised concerns about private information on Polish citizens, politicians, and other targets.
Concerns about NSO Group’s spyware have also surfaced elsewhere. WhatsApp previously accused the company of launching Pegasus attacks despite a court ban, as detailed in WhatsApp’s statement that the NSO Group launched new Pegasus spyware attacks despite the court ban.
A parliamentary committee made further findings. According to the Sejm announcement, the committee is investigating Pegasus. It reported that the CBA never got the required IT security accreditation for the system. Committee chair Magdalena Sroka also spoke about the courts. She said judges who approved the spyware did not get the full picture of its powers. That included its ability to reach large amounts of phone content.
Tusk went further than the prosecutors. He said the setup exposed Polish citizens’ data to the Israeli side. He also claimed that NSO worked with Israeli intelligence. Those points are the prime minister’s own claims. The published findings show technical access only. They do not show that Israeli intelligence received any specific surveillance records.
Legal Cases Against Former Officials Continue
The new findings add to legal action that was already underway. In February 2026, prosecutors charged the former heads of the ABW and the Military Counterintelligence Service. The charges say they failed to do their duties. The case covers approving and using the system without the needed security accreditation.
Other former officials have also faced charges. These link to the way the spyware was used. They also link to the way the surveillance material was handled. The former PiS government has defended Pegasus. It said the tool was a legitimate way to fight crime and protect national security. It also said courts approved its use against suspected offenders.
The latest findings have sharpened one question. Did Poland keep sensitive information safe while it used this technology? The gap between technical access and proven data access remains central to the case. Investigators are still studying who holds responsibility for buying the system. They are also studying who oversaw it and who used it.
