NSO Group, Israeli hacking firm, says former employee tried to sell stolen spy tools

A former employee of NSO Group, an Israeli spyware vendor that markets mobile surveillance tools to governments and law enforcement agencies, is accused of stealing the company’s intellectual property and attempting to sell it online for $50 million, Israel’s Justice Ministry said Thursday.

Authorities said in a statement that an unidentified former NSO senior programmer was arrested last month and charged in connection with the attempted sale of stolen source code and hundreds of millions of dollars worth of information involving the company’s “cyber capabilities.”

The defendant allegedly transferred the data from his workstation to an external hard drive after learning in April that he would lose his job, the statement said.

He then kept the hard drive hidden under his mattress for nearly a month before eventually trying to sell its data on the dark web in exchange for millions of dollars in cryptocurrency, the statement said.

NSO “was able to quickly identify the breach, collect evidence, identify the perpetrator and share its findings with the relevant authorities,” a company spokesperson told Forbes.

“The authorities in turn responded quickly and effectively, so that within a very short time the former employee was arrested and the stolen property was secured,” the NSO spokesperson said. “As stated clearly in the indictment, no IP or company materials have been shared with any third party or otherwise leaked, and no customer data or information was compromised.”

Headquartered in Herzliya, Israel, NSO has about 500 employees and is valued at over $900 million, Reuters reported. The company is known for designing sophisticated off-the-shelf malware used by law enforcement agencies and governments around the world, including Pegasus, a type of spyware reportedly used by Mexican federal authorities to conduct surveillance on journalists, human rights lawyers and activists.

The Israeli Justice Ministry said in the statement that the former programmer’s alleged behavior “endangered NSO and could have led to its collapse,” The Times of Israel reported.

“Beyond that, the activities of the suspect endanger national security,” the statement reportedly said.

The ministry said the defendant has been charged with trying to damage property in a way that would harm national security, theft by an employee, activities to market defense material without a permit and obstruction and interfering with computer material, The Times reported. Specifics involving the defendant’s name and the possible national security implications of his alleged conduct are barred by gag order, the report said.