A report from the University of Toronto’s Citizen Lab says the mobile phone of Greek politician Stelios Kouloglou was repeatedly hacked using spyware made by NSO Group. The report says the compromise happened at least twice between 2022 and 2023.

Kouloglou was working on the European Parliament’s PEGA committee, which was set up to examine the trade in Pegasus and other spyware used by governments. Citizen Lab says Kouloglou’s iPhone was compromised by Pegasus at least twice using a “zero-click” technique in at least one of the incidents, meaning the phone could be infiltrated without the user clicking a malicious link.

Kouloglou said the hacked device contained communications with Greece’s former prime minister Alexis Tsipras, along with private medical information and journalistic contacts. He said he is trying to determine which government might have targeted him, but the Citizen Lab report does not identify the user of the spyware.

The report also says it found evidence that the same actor may have targeted a separate set of seven independent journalists and opposition activists based in Europe, including Russian and Belarusian-speaking individuals.

In response, NSO Group representatives did not comment. The European Commission said it was addressing illegal use of spyware from multiple angles of EU law, and that attempts to access citizens’ data without authorization are unacceptable.

Citizen Lab’s John Scott-Railton said the case highlights what he called “complete impunity” for spyware abuse and argued that EU institutions have not done enough, given that someone on the committee tasked with investigating Pegasus was infected