A new assessment of the Pegasus spyware attack on Spanish President Pedro Sánchez has revealed the extraordinary scale of information extracted from his cellphone, reigniting questions about who was behind the operation and what may have happened to sensitive government data.
Spain’s National Intelligence Centre, known as the CNI, has acknowledged that Pegasus extracted approximately 2.7 gigabytes of data from Sánchez’s phone during the 2021 cyberattack.
To illustrate the enormous volume of information represented by that amount of data, the CNI estimates it could correspond to roughly 5 million text messages, 100,000 emails, 1,200 photographs or 40 hours of recorded audio, according to reports published in Spain.
A Spyware Attack on the President
Sánchez’s phone was compromised by Pegasus in May 2021, with investigators determining that approximately 2.6 gigabytes of information were extracted during the first attack and another roughly 130 megabytes during a subsequent intrusion.
The phone of then-Defense Minister Margarita Robles was also targeted.
The Spanish government said at the time that the attacks were external and had not been authorized by Spanish authorities. But the identity of the person or organization responsible for the attacks has remained a major unresolved question.
Pegasus, developed by Israeli technology company NSO Group, is among the world’s most sophisticated commercial surveillance tools. Once a device is successfully compromised, attackers can potentially gain access to highly sensitive communications and information stored on the phone.
For a sitting president, that could include private conversations, diplomatic communications, government documents, photographs, contacts and information involving national-security matters.
One of the most troubling questions surrounding the case is not simply how much data was extracted, but what the attackers obtained.
Spanish authorities have previously acknowledged that forensic investigators could establish the amount of data removed from the devices but could not necessarily determine exactly which documents or pieces of information were taken.
That means the 2.7-gigabyte figure provides an indication of the scale of the breach without answering the more consequential question: What did the attackers actually see?
The uncertainty has fueled political controversy in Spain and prompted renewed scrutiny of the government’s handling of sensitive communications.
You must be logged in to post a comment.