Five years after the Pegasus scandal broke, the European Union's own institutions remain under sustained attack from commercial surveillance tools. Stelios Kouloglou, a retired Member of the European Parliament, became the latest known target when forensic analysis by Citizen Lab revealed in July that he had been compromised with Pegasus spyware—while serving on the very parliamentary committee investigating such abuse. The breach potentially exposed confidential documents and committee deliberations to attackers.
The targeting of Kouloglou underscores a broader security crisis within EU institutions that policymakers have largely ignored. Despite mounting evidence of widespread compromise, Brussels has taken no meaningful legislative action to address commercial spyware misuse, even as the bloc's own officials become victims.
Spyware victims within EU Institutions may far exceed 60
Kouloglou joins at least 18 EU officials and 10 MEPs confirmed as targets of commercial spyware, though the true figure likely runs far higher. A 2022 draft report by the European Parliament's Committee of Inquiry to Investigate the Use of Pegasus and Equivalent Surveillance Spyware (PEGA) documented "some sixty detected infections" within the European Commission alone. A Commission letter to PEGA rapporteur Sophie in 't Veld further acknowledged that staff had received Apple compromise notifications in November 2021 and that device checks had uncovered "indicators of compromise."
The roster of confirmed targets reads like a directory of EU leadership. Roberta Metsola, President of the European Parliament, was compromised with Predator spyware. Former European Commissioner Didier Reynders fell victim to Pegasus, as did at least four other Commission staff members, including someone from then-Vice-President Věra Jourová's office. Among parliamentarians, those targeted or infected include Diana Riba, Jordi Solé, Nathalie Loiseau, Elena Yoncheva, Daniel Freund, Pierre Karleskind, Louis Michel, and Nikos Androulakis, along with Clara Ponsatí and Carles Puigdemont, who were reached through family members or staff. A Parliament security staffer also fell victim.
The scale of the breach poses acute institutional risks. Compromised devices could enable theft of sensitive EU information, counterintelligence operations, proliferation of offensive hacking tools, and strategic destabilization. "This is particularly concerning given the number and seniority of EU officials who have reportedly been targeted," said Aljosa Ajanovic, a policy advisor at European Digital Rights (EDRi). "The European institutions should be treating this as a serious institutional security problem, not simply as a collection of isolated incidents."
The threat landscape has darkened further. Google's Threat Analysis Group reported in 2024 that Russian state hackers are deploying exploits "identical or strikingly similar" to those created by spyware firms Intellexa and NSO Group. "In the current geopolitical scenario, in which the EU is facing pressures from both its West and its East, a compromised device can definitely pose a major threat to its own security, with unknown consequences," Ajanovic warned.
When asked about the Commission's response, a spokesperson declined to address either the "sixty detected infections" or potential legislative measures. The Commission merely stated that it "proactively implement[s] measures to protect [its] staff from cybersecurity threats, investing heavily in state-of-the-art tools for monitoring, detection and incident response. Such measures include the ongoing development of means to detect mobile device compromise at scale, in collaboration with other entities in the EU."
The PEGA committee, established in 2022 to investigate spyware abuse across Europe following scandals in Spain, Greece, Hungary and Poland, issued clear recommendations: adopt EU-wide legislation to prevent spyware misuse, strengthen independent oversight, guarantee victims access to legal remedies, and enforce export controls. Yet the European Commission has proposed no such legislation, despite the Parliament adopting a resolution criticizing the legislative vacuum and holding multiple debates on PEGA's status.
Brussels has instead maintained that existing rules—the GDPR, ePrivacy Directive, Cyber Resilience Act, European Media Freedom Act and Law Enforcement Directive—suffice to combat spyware abuse. This position sidesteps the need for legislation addressing commercial spyware's specific characteristics and establishing EU-wide standards. "There is clearly a political decision somewhere in the higher echelons of the Commission not to make spyware a major EU policy priority," Ajanovic observed, pointing to the disappearance of a planned communication, the absence of PEGA implementation, and the shift toward claiming existing law is adequate.
Spyware makers' access to sensitive data is facing increased scrutiny
With institutional remedies unavailable, victims like Kouloglou have turned to litigation as their primary recourse. In late September, Kouloglou filed charges against NSO Group in Athens, prompting prosecutors to open a preliminary investigation into his Pegasus targeting.
"The particular significance of the case is that the complaint does not stop at establishing that Stelios Kouloglou was targeted with Pegasus. It names specific executives of NSO Group and calls for their possible involvement and responsibility to be investigated," said Zacharias Kesses, a lawyer representing Kouloglou and other spyware victims in Greece. "Companies that develop or supply such tools cannot distance themselves from their use when there are serious indications of abuse."
Spyware vendors' control over sensitive data with national security implications is drawing new scrutiny. Court documents released in November 2024 from US litigation between NSO Group and WhatsApp revealed that NSO, not its customers, "installs and extracts" information from devices targeted by Pegasus. An October 12 inquiry into Poland's Central Anti-Corruption Bureau—which deployed Pegasus—found that the agency lacked full control over the system; NSO Group retained exclusive control of the server module responsible for infecting devices. Polish investigators also discovered that collected data was routed outside the country through anonymizing networks using foreign servers.
Intellexa faces similar scrutiny. In September, a high-ranking Greek intelligence officer filed criminal charges against four executives linked to the firm, alleging that "due to his job and official duties he manages sensitive, highly classified information, whose leakage to third parties, and even private individuals, threatens national security and constitutes espionage."
Litigation offers a path to investigation and accountability
Spyware victims confront formidable obstacles to obtaining remedies: difficulty proving targeting, challenges securing forensic evidence, absence of notification requirements, restricted access to government-held information, inadequate or politically compromised investigations, jurisdictional complications, and barriers to effective redress. With institutional mechanisms failing or unwilling to act, litigation through national courts and the European Convention on Human Rights has emerged as the primary avenue for accountability.
"Strategic litigation is essential for holding those responsible to account and obtaining justice for human rights violations when institutional mechanisms fail, or there is no political will to address them," said Cèlia Carbonell from Catalan human rights NGO Irídia, which participates in a Europe-wide litigation coalition against spyware currently pursuing nine cases across three countries. "The coalition is a space to share knowledge, strategies and ideas that can support ongoing and new litigation against spyware, with the aim of setting positive legal precedents that benefit everyone and bring about change."
Kesses emphasized that legal action is now indispensable. "What is now expected is a substantive investigation into those responsible and the extent of the breach. At the same time, the European Court of Human Rights in Strasbourg may examine the state's responsibility, provided the admissibility requirements are met," he said. "Judicial proceedings do not absolve the European Union and governments of their obligation to act."
