Incident
Mexico: journalist Carmen Aristegui receives Pegasus spyware through phishing texts
MexicoRSF rank: not recorded
Citizen Lab, R3D and Article 19 documented Pegasus spyware sent to Mexican investigative journalists Carmen Aristegui and Carlos Loret de Mola through phishing text messages, which the Mexican government denied having sent.123
What happened
On June 19 and 20, 2017, researchers at Citizen Lab, a University of Toronto research group, working with the Mexican digital rights organization R3D and the press freedom group Article 19, documented that investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with several human rights defenders and anti-corruption figures, had received phishing text messages containing fabricated warnings about family members. Clicking the links in the messages installed Pegasus spyware, made by the Israeli firm NSO Group, on the recipients' phones. NSO Group has said it sells Pegasus exclusively to governments. President Enrique Pena Nieto's administration categorically denied that any of its members engaged in surveillance or communications operations against human rights defenders, journalists or anti-corruption activists without prior judicial authorization. Citizen Lab's report said the spyware itself could not be traced back to whoever had sent it, and that there was no conclusive evidence establishing who was responsible.123
No individual or agency was conclusively identified as responsible in the source reviewed, and the government denied involvement.3
What reason was given
Stated justificationPresident Enrique Pena Nieto's administration "categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization."2
What changed for reporting
Prominent investigative journalists covering corruption and human rights in Mexico received spyware capable of reading their phones' communications, while the technical evidence could not conclusively identify who was responsible.123
Timeline
2017
Who acted
| Name | Role in this incident | Office at the time |
|---|---|---|
| Enrique Pena Nieto | other | President of Mexico |
Outlets and journalists
| Name | Kind | Relation |
|---|---|---|
| Aristegui Noticias | outlet | affected |
| Carlos Loret de Mola | journalist | affected |
| Carmen Aristegui | journalist, Aristegui Noticias | affected |
Sources
- Spyware targeted Mexican journalists and activists
- Activists and journalists in Mexico complain of government spying
Claims and evidence
Each numbered claim quotes the source it rests on.
- Citizen Lab, R3D and Article 19 documented that Aristegui and Loret de Mola received phishing texts with fabricated family warnings that installed Pegasus spyware.
Investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with human rights activists and anti-corruption figures.
Spyware targeted Mexican journalists and activists, Committee to Protect Journalists, 2017-06-20.Claim 623, checked 2026-09-22. - President Pena Nieto's administration denied that any of its members conducted surveillance against journalists or human rights defenders without judicial authorization.
categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization
Spyware targeted Mexican journalists and activists, Committee to Protect Journalists, 2017-06-20.Claim 624, checked 2026-09-22. - Citizen Lab's report said the spyware could not be traced back to its senders and there was no conclusive evidence of who was behind the attacks.
the software cannot be traced back to its original senders
Spyware targeted Mexican journalists and activists, Committee to Protect Journalists, 2017-06-20.Claim 625, checked 2026-09-22.