Loading story…
A new class-action lawsuit filed in the U.S. District Court for the Northern District of California alleges Meta misled WhatsApp users by marketing “unbreakable” end-to-end encryption while allegedly retaining and analyzing message content and enabling employee access via internal tools. The complaint—brought by plaintiffs from multiple countries and seeking global class certification—cites unnamed whistleblowers but reportedly provides no technical proof (e.g., logs or code) to substantiate claims that Meta can decrypt or read message contents; Meta spokesperson Andy Stone denied the allegations as “categorically false,” reiterating WhatsApp’s use of the Signal Protocol for end-to-end encryption.
Separately, Google agreed to pay $68 million to settle a class-action lawsuit alleging Google Assistant unlawfully recorded users’ private conversations when inadvertently triggered (e.g., via “Hey Google” misfires) and shared recordings with third parties for advertising-related purposes. The preliminary settlement, also filed in Northern California federal court, still requires judicial approval and applies to purchasers of Google devices dating back to May 2016; Google reportedly settled without admitting wrongdoing. Together, the cases underscore ongoing legal and regulatory exposure tied to consumer privacy representations, data handling, and the gap between product claims and alleged internal access/collection practices.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
After the lawsuit became public, Meta and WhatsApp spokesperson Andy Stone denied the claims, stating WhatsApp uses the audited Signal Protocol and that Meta cannot access users' plaintext messages or encryption keys. The company called the suit frivolous and said it would seek sanctions against plaintiffs' counsel.
Google agreed to pay $68 million to settle a class-action lawsuit alleging Google Assistant illegally recorded users' private conversations and shared them with third parties without consent. The preliminary settlement was filed in federal court in Northern California and still requires judicial approval, with no admission of wrongdoing by Google.
On January 23, 2026, plaintiffs filed a class-action lawsuit in the U.S. District Court for the Northern District of California alleging Meta misled WhatsApp users by claiming messages were protected by unbreakable end-to-end encryption while allegedly storing and analyzing message contents internally.
A Bureau of Industry and Security internal inquiry, reportedly called 'Operation Sourced Encryption,' examined whether Meta could access WhatsApp message content despite its end-to-end encryption claims. The probe was reportedly halted after roughly 10 months, and the agency later said it was not investigating WhatsApp or Meta for export-law violations.
The proposed Google settlement covers people who purchased Google devices starting in May 2016, marking the beginning of the class period tied to allegations that Google Assistant recorded private conversations without consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WhatsApp and parent company Meta won a major legal victory against **NSO Group** over the use of **Pegasus** spyware to hack roughly **1,400 users** through a WhatsApp audio-calling vulnerability. The case, filed in 2019, survived NSO’s attempts to dismiss it, including arguments that it should share sovereign immunity with its government customers, and the **U.S. Supreme Court** later allowed the suit to proceed. A court subsequently found NSO liable for violating the **Computer Fraud and Abuse Act**, California anti-hacking law, and WhatsApp’s terms of service, and a jury later awarded WhatsApp more than **$167 million** in damages. Court proceedings and later reporting exposed new details about the spyware operation and NSO’s conduct during discovery. Trial evidence described a **zero-click** Pegasus delivery chain using a fake WhatsApp call and infrastructure designed to infect targets using only a phone number, and testimony indicated NSO continued developing WhatsApp-based vectors after the lawsuit began under codenames including **Eden**, **Heaven**, **Erised**, and **Hummingbird**. Separate reporting alleged NSO sought Israeli government help to keep Pegasus source code and malware documents out of U.S. court, leading to a secret seizure of internal files, while disclosures in the case identified customers including **Mexico, Saudi Arabia, and Uzbekistan** and reinforced longstanding allegations that Pegasus had been used against journalists, activists, and other civil society targets.
Jun 29, 2026
Meta said it disrupted a new **NSO Group-linked** operation that used **one-click phishing** against WhatsApp users and has asked a U.S. federal court to hold the spyware vendor in contempt for allegedly violating a permanent injunction. According to WhatsApp, the activity relied on malicious external links, social engineering, and WhatsApp test accounts and groups used to stage the attacks, echoing tactics previously associated with **Pegasus** spyware campaigns. Meta also published malicious domains and related indicators tied to the infrastructure and said it removed the accounts involved. The alleged targeting primarily affected fewer than 10 users in **Jordan and Lebanon**, and WhatsApp said it found no evidence of successful device compromise. The filing follows earlier court action over NSO’s 2019 campaign that exploited a WhatsApp **VOIP stack** buffer overflow to compromise about 1,400 users, a case that resulted in a jury award of more than **$167 million** in punitive damages plus compensatory damages and a court order barring NSO from targeting WhatsApp or its users. Meta said the new activity shows continued exploit development and spyware operations despite that injunction.
Aug 11, 2026
Google agreed to a preliminary **$135 million** class action settlement in *Taylor v. Google LLC* over allegations that Android devices transmitted cellular data to Google without users’ consent, including while phones were idle and apps were closed. The proposed settlement covers roughly **100 million U.S. Android users** who used an Android device with a cellular data plan from **Nov. 12, 2017** until final approval, though Google denied wrongdoing and said it settled to avoid further litigation. Eligible users can file claims for payments that may reach **up to $100**, with final amounts depending on participation levels and deductions for fees and costs. As part of the agreement, Google will revise Google Play terms to better disclose passive data transfers, obtain user consent during device setup, and stop collecting data entirely when the **"allow background data usage"** setting is turned off. A final approval hearing is scheduled for **June 23**, and payments would be issued only after court approval and any appeals are resolved.
Jun 29, 2026