iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In 2018, an NSO Group employee was accused of copying Pegasus-related software and offering it on the dark web for $50 million. The public reporting describes an alleged theft and attempted sale—not a confirmed transaction, public release, or proven transfer to a buyer. The incident is most useful today as a case study in controlling access to sensitive intellectual property, particularly during onboarding, performance concerns, and offboarding.
What the 2018 case alleges
Christopher Burgess’s July 6, 2018 analysis in CSO, drawing on an indictment and reporting by Globes, said an NSO Group employee who had worked there for roughly three months allegedly copied Pegasus-related software and offered it for sale on the dark web.
Contemporaneous reports from The Times of Israel and Reuters via Ynetnews described an Israeli indictment against an unnamed 38-year-old former employee. The Justice Ministry’s allegations, as summarized by those reports, included stealing company material and unlawfully marketing defense material. The employee’s conduct should therefore be treated as an allegation, not an established finding of guilt.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The reported asking price was $50 million. That figure describes an alleged offer, not money received or evidence that a transaction was completed.
#1 Best Overall
How the reported sequence unfolded
- The employee allegedly obtained Pegasus-related software during a short period of employment—approximately 90 days, according to Burgess’s account.
- The material was allegedly offered to a prospective buyer on the dark web for $50 million.
- Contemporaneous coverage said the potential buyer alerted NSO Group.
- Law enforcement then became involved, and prosecutors filed an indictment against the former employee.
What is—and is not—established publicly
| Question | What the contemporaneous reporting supports |
|---|---|
| Was software allegedly taken? | The indictment and news reports described an alleged theft of Pegasus-related material. |
| Was it offered for sale? | Yes, the reports described an alleged $50 million offer on the dark web. |
| Was the asking price paid? | Not established. The reported amount was an asking price, not a confirmed sale. |
| Did a buyer receive a copy? | Not established. The public account did not show that the material reached a buyer or another third party. |
| Was customer data compromised? | NSO Group said company materials were not shared with a third party and that customer data was not compromised. That is the company’s contemporaneous assurance, not an independently demonstrated conclusion in the cited coverage. |
| What happened in court afterward? | The sources available for this article do not establish a final disposition or any appeal outcome. |
Why this is an insider-risk lesson, not a Pegasus product story
Pegasus is described in the coverage as government surveillance software, not a consumer product. The enduring issue is how an organization protects high-value source code and other defense-related intellectual property when an authorized user becomes a risk.
Burgess framed the case as a set of governance questions, including: “Does your firm monitor the internal access of new employees?” He also asked: “When an employee is identified as having performance issues, is the employee highlighted to the insider threat prevention team?” Those questions identify controls worth examining; they do not prove that any particular control would have prevented this alleged incident.
Controls organizations should examine
Least-privilege access to source code
- Give new employees only the repositories, branches, build systems, credentials, and documentation required for their assigned work.
- Separate the ability to read source from the ability to export, build, sign, or deploy it.
- Use time-limited access for sensitive projects and require an explicit business justification for expansion.
- Review privileged access independently of the employee’s manager, especially for defense, cryptographic, and surveillance code.
Monitoring and alert handling
- Record repository reads, bulk clones, archive creation, unusual API use, privileged-account activity, and transfers to unfamiliar destinations.
- Define what constitutes an actionable alert before an incident occurs; volume alone is not a response plan.
- Ensure alerts reach investigators who can combine identity, device, network, human-resources, and legal context.
- Preserve logs with reliable timestamps and access controls so investigators can reconstruct events without altering evidence.
Removable media and bulk-download controls
- Restrict removable storage on systems holding sensitive intellectual property and log approved exceptions.
- Set thresholds for unusual downloads, repository-wide exports, and compression of many files into a single archive.
- Use data-loss-prevention rules as one layer, while recognizing that source-code formats, encrypted archives, and legitimate engineering workflows can complicate detection.
Changes in job status
- Trigger an access review when an employee changes teams, enters a notice period, is suspended, or is terminated.
- Revoke tokens, VPN access, cloud sessions, signing keys, shared secrets, and physical badges through a coordinated workflow.
- Collect company devices and preserve relevant logs before wiping or reassigning equipment.
- Document who approved continued access and for how long when business needs require an exception.
Incident-response coordination
- Define in advance when security, legal, human resources, executive leadership, and law enforcement must be involved.
- Use a small, need-to-know response group so an investigation does not create additional disclosure risk.
- Preserve suspected copies, messages, access logs, and device images before attempting remediation.
- Separate confirmed observations from employee statements, hypotheses, and allegations in every case record.
A practical review for security and HR teams
- Map the crown jewels. Identify repositories, build artifacts, credentials, customer data, and documents whose loss would create legal, safety, or competitive harm.
- Map who can reach them. Compare actual permissions with job requirements, including inherited group membership and dormant accounts.
- Check short-tenure access. Review what newly hired staff can access during their first weeks and whether approvals are automatic or human-reviewed.
- Define risk signals carefully. Performance concerns, policy violations, abrupt role changes, unusual access, and attempts to bypass controls may warrant review, but none is proof of malicious intent by itself.
- Test the offboarding path. Run a documented exercise from the HR event through token revocation, device return, evidence preservation, and manager confirmation.
- Measure response quality. Track how quickly alerts are triaged, how often they are escalated appropriately, and whether investigators can explain the final disposition.
What this case cannot prove about security products
The collected accounts do not compare data-loss-prevention or insider-risk vendors, and they do not establish which product would have detected or stopped the alleged conduct. Organizations should evaluate products against their own source-code systems, removable-media policies, cloud services, staffing model, privacy obligations, and response capacity rather than treating this case as a product benchmark.
Legal and reporting limits
The public material cited here covers the 2018 allegation, indictment, attempted sale, and attributed company response. It does not establish the case’s final court disposition or any appeal. Any claim that the employee was convicted, acquitted, or that Pegasus was successfully sold would go beyond the cited reporting.
Quick Recap
Best Value
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
