SAN FRANCISCO — Most of WhatsApp’s 3 billion users probably don’t know it, but a prominent Los Angeles law firm is trying to speak on their behalf in a lawsuit filed against its owner Meta that alleged the company can “access virtually all of WhatsApp users’ purportedly ‘private’ communications.”
Security experts questioned the lack of technical detail in the lawsuit, and WhatsApp denied the claims.
The complaint filed in California by Quinn Emanuel Urquhart & Sullivan on behalf of seven WhatsApp users from Australia, Brazil, India, Mexico and South Africa seeks class-action status to represent users around the globe, excluding those in the U.S. and Canada, who would be required to enter arbitration, and users in the U.K. and Europe, who would have to use courts there.
The suit cited unidentified “courageous” whistleblowers who the lawsuit claims have discovered that WhatsApp staff could send an electronic request to the company’s engineers asking for messages from a specific user ID. That user’s private messages as well as their Instagram and Facebook posts would then appear on the screen of the staffer who sent the request, the suit claims, contradicting WhatsApp’s long-standing assertions that it cannot access user messages.
The allegations baffled security experts, who know WhatsApp as the most popular messaging app with end-to-end encryption. That means messages are fully encrypted on the sender’s device and stay that way until they reach the recipient’s device, preventing anyone with access to the systems or networks in between from reading message contents.
The lawsuit against WhatsApp asserts a variety of legal theories, including that it breached the Federal Wiretap Act and California laws on hacking and privacy.
WhatsApp spokesman Carl Woog called the lawsuit “frivolous” and denied that the company can access users’ messages. On Wednesday, WhatsApp sent a letter to Quinn Emanuel threatening to seek sanctions against the firm’s lawyers in court if they do not withdraw the suit, according to a copy reviewed by The Washington Post.
“We’re pursuing sanctions against Quinn Emanuel for filing a meritless lawsuit that was designed purely to grab headlines,” Woog said by WhatsApp message.
Woog also suggested the suit against WhatsApp was related to Quinn Emanuel’s work on a separate case, between the social network giant and spyware company NSO Group. The surveillance vendor is appealing a $167 million judgment entered against it in federal court last May, after a jury found that NSO’s Pegasus tool exploited a weakness in the WhatsApp app to take over control of the phones of more than 1,000 users.
An attorney from Quinn Emanuel joined NSO’s legal team on that case on Jan. 22, according to legal filings, and different attorneys from that firm filed the case against WhatsApp on Jan. 23. “We believe a lawsuit like this is an attempt to launder false claims and divert attention from their dangerous spyware,” Woog said.
Adam Wolfson, a Quinn Emanuel attorney on the case against WhatsApp and Meta, said, “Our colleagues’ defense of NSO on appeal has nothing to do with the facts disclosed to us and which form the basis of the lawsuit we brought for worldwide WhatsApp users.”
“We look forward to moving forward with those claims,” Wolfson said.
NSO did not respond to a request for comment. In its long-running case with WhatsApp, its arguments have included a claim of immunity on the grounds that it was working on behalf of national security agencies in various countries and that its actions were in pursuit of criminals and terrorists.
WhatsApp’s competitors wasted no time seizing on the lawsuit alleging that its staff could read user messages.
Pavel Durov, founder of messaging platform Telegram, wrote on X: “You’d have to be braindead to believe WhatsApp is secure in 2026.” He added that his own team had found ways to attack WhatsApp, although that is a different claim from the suit’s assertion that it is insecure by design.
Elon Musk, the Tesla CEO who also leads social platform X, boosted the suit in a post that claimed “WhatsApp is not secure.” He promoted X’s messaging features and added that “even Signal is questionable,” referring to the nonprofit of that name that developed the heavily vetted open-source protocol that WhatsApp is built upon.
Because messages over Telegram are not end-to-end encrypted by default — though the app does offer it as an option — and it has had substantial infrastructure in Russia, many experts do not recommend it for sensitive conversations. X’s recent efforts to allow end-to-end encryption have been publicly faultedby its own security auditor.
The lawsuit against WhatsApp filed in San Francisco’s U.S. District Court does not say how the alleged whistleblowers obtained their information or with whom they shared it.
If the allegations prove true, the case could hurt the credibility of the word’s most-popular fully encrypted messenger and put Meta at substantial financial risk. For that reason, the suit prompted articles and long debates on websites and message boards devoted to technology and privacy.
But the case was criticized by several experts who have studied messaging security.
“It’s pretty long on accusations and thin on any sort of evidence,” Matthew Green, a cryptography professor at Johns Hopkins University, said over Signal. “WhatsApp has been very consistent about using end-to-end encryption. This lawsuit seems to be a nothingburger.”
Nicholas Weaver, a security researcher at the International Computer Science Institute, criticized the lawsuit in a post on Bluesky for lacking detail needed to back up its claims. “They don’t even do a citation to the actual whistleblowers,” he wrote, calling the suit “ludicrous.”
The lawsuit filed against WhatsApp follows another accusing the company of lax security, filed last year by former WhatsApp security engineer Attaullah Baig. He alleged that he was retaliated against after pointing out security issues that he said needed fixing. WhatsApp has disputed his claims and said Baig misrepresented its work on security and record of protecting users’ privacy. The case is still ongoing.
Baig claimedthat too many staff engineers had access to data about WhatsApp users and that it had not come up with an effective means to prevent widespread thefts of accounts, which he estimated occurred hundreds of thousands of times per day.
Baig did not respond to a request for comment on the new case against WhatsApp. His own lawsuit did not say that the company could read user messages, except when users themselves shared them with WhatsApp when asking for support.
The post Lawsuit claims WhatsApp has a gaping security hole. Experts doubt it. appeared first on Washington Post.
