Incident Types: The types of cybersecurity incidents that have occurred include Data Leak, Breach and Vulnerability.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with server-side fix, and remediation measures with patch applied in version 2.2450.6, and communication strategy with urging immediate update to patched version, and and third party assistance with amnesty international security lab (investigation), and containment measures with whatsapp server-side patches to block exploit, containment measures with user notifications with mitigation steps, and remediation measures with whatsapp app updates (ios v2.25.21.73+, mac v2.25.21.78+), remediation measures with apple security updates for image i/o framework, remediation measures with factory reset recommendation for affected users, and recovery measures with device updates (os and whatsapp), recovery measures with security feature enablement (e.g., google advanced protection for android), and communication strategy with direct notifications to affected users, communication strategy with public advisory via blog/press, communication strategy with collaboration with amnesty international for technical details, and and third party assistance with amnesty international security lab, third party assistance with university of toronto's citizen lab, and containment measures with patching vulnerable whatsapp versions (ios/macos), containment measures with disrupting paragon's graphite spyware campaign, and remediation measures with user notifications, remediation measures with factory reset recommendations, remediation measures with os/software update advisories, and communication strategy with direct alerts to targeted users, communication strategy with public security advisory, communication strategy with media statements, and incident response plan activated with yes (collaboration with researchers), and third party assistance with university of vienna security researchers, and containment measures with cardinality-based rate limiting using probabilistic data structures, containment measures with restricted access to profile pictures and status messages (even if set to public), containment measures with removed timestamps from profile picture queries, and remediation measures with fixed key reuse vulnerability in android clients, remediation measures with enhanced api protections against bulk enumeration, and communication strategy with public disclosure with mitigation details; emphasized end-to-end encryption remains intact, and enhanced monitoring with likely (implied by rate-limiting fixes)..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Malicious WhatsApp message (zero-click) and Linked device synchronization messages (WhatsApp vulnerability).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Mobile Numbers, Phone Numbers, , Messages, Device-Stored Data (Potential Full Access), , Device Metadata, Potential Communications (Via Spyware), User Activity, , Phone Numbers, Profile Pictures, Status Messages, Business Account Info, Device Details, Encryption Keys, Timestamps, Facial Recognition Data and .

Incident Response Plan: The company's incident response plan is described as Yes (Collaboration with researchers).

Third-Party Assistance: The company involves third-party assistance in incident response through Amnesty International Security Lab (investigation), , Amnesty International Security Lab, University of Toronto's Citizen Lab, , University of Vienna Security Researchers.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Server-side fix, Patch applied in version 2.2450.6, WhatsApp app updates (iOS v2.25.21.73+, Mac v2.25.21.78+), Apple security updates for Image I/O framework, Factory reset recommendation for affected users, , User notifications, Factory reset recommendations, OS/software update advisories, , Fixed key reuse vulnerability in Android clients, Enhanced API protections against bulk enumeration, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by whatsapp server-side patches to block exploit, user notifications with mitigation steps, , patching vulnerable whatsapp versions (ios/macos), disrupting paragon's graphite spyware campaign, , cardinality-based rate limiting using probabilistic data structures, restricted access to profile pictures and status messages (even if set to public), removed timestamps from profile picture queries and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Device updates (OS and WhatsApp), Security feature enablement (e.g., Google Advanced Protection for Android), .

Key Lessons Learned: The key lessons learned from past incidents are The incident highlights the significant risks associated with spyware operations and the challenge of regulating spyware use to protect fundamental rights and freedoms.Zero-click exploits pose severe risks even to fully patched systems when chained with other vulnerabilities.,Cross-platform vulnerabilities (e.g., Apple Image I/O) can amplify attack surfaces for apps like WhatsApp.,Proactive user notification and clear mitigation steps are critical for limiting damage from targeted attacks.Zero-click vulnerabilities in messaging apps remain high-value targets for APT groups.,Cross-platform vulnerabilities (e.g., WhatsApp + Apple OS) amplify attack impact.,Proactive user notifications and remediation guidance are critical for targeted attacks.Centralized messaging platforms face inherent privacy risks when convenience features (e.g., contact discovery) lack abuse protections at scale.,Weak rate limiting can enable mass enumeration attacks, exposing billions of records.,Publicly accessible data (e.g., profile pictures) can become high-risk when combined with other exposed attributes (e.g., phone numbers).,Data breaches have long-term impacts; 50% of phone numbers from a 2021 leak remained active on WhatsApp in 2025.,Facial recognition risks emerge when profile pictures are linked to identifiers like phone numbers.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Enhance user education on privacy settings and risks of public profile data., Monitor for secondary risks (e.g., phishing, spam) stemming from exposed data., Audit third-party API access and contact discovery mechanisms for abuse potential., Implement stricter rate limiting with probabilistic data structures (e.g., Bloom filters) to prevent enumeration attacks., Conduct regular red-team exercises to test for large-scale data exposure vectors., Restrict default visibility of profile pictures/status messages and even for 'public' settings..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: WhatsApp Security Advisory, and Source: Apple Security Update (CVE-2025-43300), and Source: Amnesty International Security Lab, and Source: Malwarebytes Blog (Mitigation Guidance), and Source: WhatsApp Security Advisory (CVE-2025-55177)Url: https://www.whatsapp.com/security/advisories/2025Date Accessed: 2025-09-20, and Source: BleepingComputer - WhatsApp patches zero-day used in Paragon spyware attacksUrl: https://www.bleepingcomputer.com/news/security/whatsapp-patches-zero-day-used-in-paragon-spyware-attacks/Date Accessed: 2025-09-20, and Source: Amnesty International Security Lab StatementUrl: https://www.amnesty.org/en/latest/news/2025/09/whatsapp-spyware-campaign-targets-journalists/Date Accessed: 2025-09-20, and Source: Apple Security Updates (CVE-2025-43300)Url: https://support.apple.com/en-us/HT214023Date Accessed: 2025-09-15, and Source: University of Vienna Security Research Team, and Source: WhatsApp Security Advisory (2025), and Source: Comparison with 2021 Facebook Data Leak.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Urging immediate update to patched version, Direct Notifications To Affected Users, Public Advisory Via Blog/Press, Collaboration With Amnesty International For Technical Details, Direct Alerts To Targeted Users, Public Security Advisory, Media Statements and Public disclosure with mitigation details; emphasized end-to-end encryption remains intact.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Direct Notifications To Affected Users With Factory Reset Instructions., Public Guidance On Updating Devices And Apps., Factory Reset Recommendation For Potentially Compromised Devices., Urgent Update Prompts For Whatsapp And Device Os., Security Best Practices (E.G., Enabling Advanced Protection Features)., , Targeted Users Notified Via In-App Alerts With Remediation Steps., Public Advisory Urging Updates To Whatsapp And Device Os., Factory Reset Recommended For Potentially Compromised Devices., Keep Whatsapp And Device Os Updated To Latest Versions., Monitor For Unusual Device Behavior (Indicative Of Spyware)., , WhatsApp notified users via blog post and in-app notifications about privacy enhancements. and Users advised to review privacy settings and limit public profile data..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Amnesty International Security Lab (Investigation), , Amnesty International Security Lab, University Of Toronto'S Citizen Lab, , University of Vienna Security Researchers, Likely (implied by rate-limiting fixes).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Server-side fix, Apple: Tightened Memory Bounds Checking In Image I/O Framework., Whatsapp: Patched Synchronization Message Authorization And Updated Client Apps., User Guidance: Factory Reset And Update Enforcement., , Patched Whatsapp Ios/Macos Clients To Version 2.25.21.73+., Enhanced Monitoring For Linked Device Synchronization Abuses., Collaboration With Apple To Address Os-Level Zero-Day (Cve-2025-43300)., Proactive User Notifications For Targeted Individuals., , Deployed Probabilistic Rate Limiting (E.G., Bloom Filters) To Prevent Enumeration., Restricted Public Access To Profile Pictures/Status Messages., Removed Timestamps From Profile Picture Queries To Limit Metadata Exposure., Patched Android Key Reuse Vulnerability., Enhanced Api Monitoring For Abusive Queries., .

Last Attacking Group: The attacking group in the last incident were an Paragon (suspected)Advanced persistent threat (APT) actors and University of Vienna Security Researchers (Ethical Disclosure).

Most Recent Incident Detected: The most recent incident detected was on 2024-12-01.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-04-01.

Most Recent Incident Resolved: The most recent incident resolved was on 2025-09-20.

Most Significant Data Compromised: The most significant data compromised in an incident were Mobile Numbers, , Phone Numbers, , Potential data theft, Messages, Device data (potential full access), , Potential device compromise, Spyware installation (e.g., Graphite), , Phone Numbers (3.5 billion), Public Profile Pictures (77 million from US accounts), Status Messages, Business Account Information, Device Details, Encryption Keys, Timestamps, Facial Recognition Data (66% of profile pictures contained detectable faces) and .

Most Significant System Affected: The most significant system affected in an incident was iOS devicesMac devicesAndroid devices (limited scope) and WhatsApp for iOS (<2.25.21.73)WhatsApp Business for iOS (<2.25.21.78)WhatsApp for Mac (<2.25.21.78)Apple iOS/macOS (via CVE-2025-43300) and WhatsApp Contact Discovery APIWhatsApp Android Clients (Key Reuse Vulnerability).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was amnesty international security lab (investigation), , amnesty international security lab, university of toronto's citizen lab, , University of Vienna Security Researchers.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were WhatsApp server-side patches to block exploitUser notifications with mitigation steps, Patching vulnerable WhatsApp versions (iOS/macOS)Disrupting Paragon's Graphite spyware campaign and Cardinality-based rate limiting using probabilistic data structuresRestricted access to profile pictures and status messages (even if set to public)Removed timestamps from profile picture queries.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Phone Numbers, Potential device compromise, Device data (potential full access), Public Profile Pictures (77 million from US accounts), Business Account Information, Spyware installation (e.g., Graphite), Mobile Numbers, Status Messages, Device Details, Timestamps, Phone Numbers (3.5 billion), Encryption Keys, Potential data theft, Messages and Facial Recognition Data (66% of profile pictures contained detectable faces).

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 4.1B.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Facial recognition risks emerge when profile pictures are linked to identifiers like phone numbers.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enhance user education on privacy settings and risks of public profile data., Enable advanced security features (e.g., Google Advanced Protection for Android)., Monitor for unusual device behavior (e.g., battery drain, data usage spikes)., Organizations should audit third-party app dependencies (e.g., Image I/O framework) for shared vulnerabilities., Use mobile security solutions (e.g., Malwarebytes) for additional protection., Expand threat intelligence sharing with civil society organizations (e.g., Citizen Lab, Amnesty International)., Monitor for secondary risks (e.g., phishing, spam) stemming from exposed data., Implement stricter authorization controls for linked device synchronization., Audit third-party API access and contact discovery mechanisms for abuse potential., Implement stricter rate limiting with probabilistic data structures (e.g., Bloom filters) to prevent enumeration attacks., Perform a factory reset if notified by WhatsApp of potential compromise., Enhance collaboration with OS vendors (e.g., Apple) to mitigate cross-platform risks., Conduct regular red-team exercises to test for large-scale data exposure vectors., Accelerate patch deployment for zero-day vulnerabilities in widely used applications., Immediately update WhatsApp and device OS to the latest versions., Restrict default visibility of profile pictures/status messages and even for 'public' settings..

Most Recent Source: The most recent source of information about an incident are WhatsApp Security Advisory, Amnesty International Security Lab, WhatsApp Security Advisory (2025), University of Vienna Security Research Team, Malwarebytes Blog (Mitigation Guidance), Comparison with 2021 Facebook Data Leak, Amnesty International Security Lab Statement, BleepingComputer - WhatsApp patches zero-day used in Paragon spyware attacks, WhatsApp Security Advisory (CVE-2025-55177), Apple Security Updates (CVE-2025-43300) and Apple Security Update (CVE-2025-43300).

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.whatsapp.com/security/advisories/2025, https://www.bleepingcomputer.com/news/security/whatsapp-patches-zero-day-used-in-paragon-spyware-attacks/, https://www.amnesty.org/en/latest/news/2025/09/whatsapp-spyware-campaign-targets-journalists/, https://support.apple.com/en-us/HT214023 .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (WhatsApp and Amnesty International collaboration).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Direct notifications to affected users with factory reset instructions., Public guidance on updating devices and apps., Targeted users notified via in-app alerts with remediation steps., Public advisory urging updates to WhatsApp and device OS., WhatsApp notified users via blog post and in-app notifications about privacy enhancements., .

Most Recent Customer Advisory: The most recent customer advisory issued were an Factory reset recommendation for potentially compromised devices.Urgent update prompts for WhatsApp and device OS.Security best practices (e.g., enabling advanced protection features)., Factory reset recommended for potentially compromised devices.Keep WhatsApp and device OS updated to latest versions.Monitor for unusual device behavior (indicative of spyware). and Users advised to review privacy settings and limit public profile data.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Malicious WhatsApp message (zero-click) and Linked device synchronization messages (WhatsApp vulnerability).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Bug in WhatsApp's platform, Zero-Day Vulnerability, Insufficient bounds checking in Apple Image I/O framework (CVE-2025-43300).Incomplete authorization for WhatsApp linked device synchronization (CVE-2025-55177).Exploit chaining enabled zero-click compromise without user interaction., Incomplete authorization in WhatsApp's linked device synchronization.Lack of user interaction requirements for exploit execution (zero-click).Cross-platform dependency risks (WhatsApp + Apple OS vulnerabilities)., Inadequate rate limiting in contact discovery APIOver-permissive access to public profile data (pictures, statuses, timestamps)Lack of cardinality-based protections against bulk queriesKey reuse vulnerability in Android clients.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Server-side fix, Apple: Tightened memory bounds checking in Image I/O framework.WhatsApp: Patched synchronization message authorization and updated client apps.User guidance: Factory reset and update enforcement., Patched WhatsApp iOS/macOS clients to version 2.25.21.73+.Enhanced monitoring for linked device synchronization abuses.Collaboration with Apple to address OS-level zero-day (CVE-2025-43300).Proactive user notifications for targeted individuals., Deployed probabilistic rate limiting (e.g., Bloom filters) to prevent enumeration.Restricted public access to profile pictures/status messages.Removed timestamps from profile picture queries to limit metadata exposure.Patched Android key reuse vulnerability.Enhanced API monitoring for abusive queries..