Supreme Audit Office says it fell victim to thousands of cyberattacks

The head of the NIK is a longtime critic of Poland's ruling, right-wing nationalist Law and Justice (PiS) party.

Reports by the Associated Press that NSO Group's Pegasus software was used to hack the phones of government critics, including a senator for the largest opposition party, have drawn accusations that security services are eroding democratic norms.

Security services spokesperson Stanisław Żaryn denied this on Friday. "The insinuations inspired by (NIK director) Marian Banaś concerning the alleged surveillance of NIK employees by the special services are false," he said in a tweet.

Senior figures in the PiS government have confirmed that it bought sophisticated spyware developed by the Israel-based NSO Group, but denied that it had been used against political opponents.

A PiS spokesperson did not immediately respond to Reuters request for comment on the NIK statement.

Private radio broadcaster RMF FM was the first to report on cyberattacks on NIK.

NIK spokesperson Łukasz Pawelski, as well as a member of a team assessing the technology's effect on NIK who requested anonymity, confirmed RMF's reporting to Reuters, adding that it affected over 100 smart phones, according to their findings. The other 400 targets included various SIM card-operated devices.

They said the most attempted attacks occurred in May 2020 while the NIK was investigating a planned presidential election during a coronavirus lockdown in which only mail-in ballots were to be allowed, and in October and November 2021 when the office was publishing a report on a fund tied to the justice ministry.

Last May, Banaś asked prosecutors to launch a criminal investigation against Prime Minister Mateusz Morawiecki and other government officials over the organisation of the 2020 presidential election.

Israel has come under global pressure over allegations that Pegasus has been abused by some foreign client governments to spy on human rights activists, journalists and politicians.

NSO has said it cannot confirm or deny any existing or potential customers for Pegasus. It said it does not operate the system once sold to its governmental customers nor is it involved in any way in the system’s operation.