In 2019, the Financial Times revealed that WhatsApp notified several Rwandan opposition leaders that their phones had been attacked by Pegasus. According to FT, “a considerable number” of the 1,400 targeted individuals detected by WhatsApp were Rwandan numbers.
In July 2021, the Pegasus Project disclosed that more than 3,500 Rwandan phone numbers were selected by Rwanda for potential surveillance using Pegasus, including journalists, lawyers, activists, government officials or politicians (the government of Rwanda denied using Pegasus). The investigation also revealed that the cell phone belonging to Carine Kanimba, the daughter of an outspoken critic of President Paul Kagame, was infected by the spyware in Belgium on a Belgian phone number.
In September, Belgian media outlets Le Soir and Knack revealed that the Belgian secret services (SGRS) found probable traces of Pegasus infection in the phones of Belgian journalist Peter Verlinden and his Belgian wife of Rwandan origin Marie Bamutese.
Just one year after the publication of Project Pegasus, the consortium coordinated by Forbidden Stories revealed the infection of another close relative of Paul Rusesabagina, his nephew Jean-Paul Nsonzrumpa, who lives in Belgium. According to the analyses conducted by Citizen Lab, his phone was infected several times in October and November 2020.
In June 2023, the European Parliament adopted the PEGA committee’s recommendations with a vast majority. MEPs called for full investigations and safeguards to prevent spyware abuse and saw “strong indications” that the government of Rwanda had spied on EU citizens, including heads of state.