The article says: "The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to

The article says: "The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to help clients hack into the cellphones of at least 1,400 users." The actual complaint reads: "Between in and around April 2019 and May 2019, Defendants used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices (“Target Devices”). Defendants’ malware was designed to infect the Target Devices for the purpose of conducting surveillance of specific WhatsApp users (“Target Users”). Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices. Defendants’ actions were not authorized by Plaintiffs and were in violation of WhatsApp’s Terms of Service. In May 2019, Plaintiffs detected and stopped Defendants’ unauthorized access and abuse of the WhatsApp Service and computers." https://context-cdn.washingtonpost.com/notes/prod/default/documents/bf5edf35-5672-49fa-aca1-edefadff683f/note/8ef25c0d-fee9-416a-b7f9-e0a4dedc66f2.pdf https://context-cdn.washingtonpost.com/notes/prod/default/do... In other words: WhatsApp does not allege a server breach. It alleges that phones were hacked via carefully crafted messages to trigger an exploit[1] on the phones, but to do that, hackers sent the messages via WhatsApp servers. They mention that, because otherwise they would have less of an argument to sue over. As far as I can tell, they're alleging that NSO Group was part of a scheme to interfere with the WhatsApp relay servers and to break the TOS, stated several different ways under different theories and laws. [1] this one https://nvd.nist.gov/vuln/detail/CVE-2019-3568 https://nvd.nist.gov/vuln/detail/CVE-2019-3568