Security researchers have confirmed that Greek journalist and former politician Stelios Kouloglou had his phone hacked with the notorious Pegasus spyware while serving on an investigatory committee probing abuses of this same surveillance tool. The hacks suggest intense focus on the committee’s inner workings, raising questions about how governments use spyware.

The deliberate compromise of Kouloglou’s phone was deemed “reckless” by one European lawmaker. The timing and targeting imply a direct attack on the rule of law. Kouloglou plans to sue NSO Group, the Israeli-headquartered company behind Pegasus.

Citizen Lab researchers did not attribute the hack to a specific country but noted that the government customer used the same email address as in previous campaigns that targeted journalists across Europe. The exploit was a zero-click bug that broke into Kouloglou’s iPhone despite it being patched by Apple.

The hacks coincide with intense discussions over Pegasus abuses, suggesting they were aimed at stifling whistleblowers and investigators. Kouloglou described anger when learning of the breach, saying: “All your personal data, not just professional exchanges or messages with ministers — but also the very private things.”