Germany Warns Bundestag Members and Ministers Their iPhones May Have Been Targeted by Mercenary Spyware

Members of the German Bundestag and the federal government have been told their iPhones may have been targeted by commercial spyware.

Digital Affairs Minister Karsten Wildberger confirmed it Sunday, Nov. 1, on ARD's "Bericht aus Berlin." He described "a notification from Apple that certain devices may have been compromised with so-called spyware."

What Germany's cyber agency told recipients

A letter from the Federal Office for Information Security, the BSI, says the Apple alerts began reaching German phones on Thursday, Oct. 29. They warned that Apple had detected an attack using "mercenary spyware."

The BSI wrote to everyone affected. Its advice: assume, as a precaution, that the device may have been compromised. Apple's alerts do not say whether an attack actually succeeded, so the agency is not taking chances.

Wildberger said the BSI "reacted super quickly." He did not say how many politicians received alerts or who they are.

The BSI said it has no further information on the cause or background of the notifications.

What this kind of spyware can do

According to the BSI, tools of this type can read messages, including those sent on encrypted apps. They can also reach calls, contacts, calendars and location data, and switch on a phone's microphone and camera.

Apple says it sends threat notifications when it believes a user has been individually targeted by mercenary spyware, which it calls "vastly more sophisticated than regular cybercriminal activity." The alerts appear on the lock screen and in settings, and also arrive by email.

Apple does not name the attacker, the vendor or the method behind a given wave.

The government's response

Government spokesman Stefan Kornelius said Berlin is taking the incident and the warning "very seriously." He said authorities are working intensively to investigate and to inform and support those affected. He would not say whether Chancellor Friedrich Merz is among the targets.

Wildberger was cautious about what lies behind the alerts. "It is purely speculative at this stage what exactly this involves. We will have to wait and see," he said. He called the case "naturally something that causes us great concern." He also said he would not necessarily attribute it to an artificial intelligence attack, since spyware has been aimed at phones for some time.

The Financial Times reported, citing security officials, that the attack used a "zero-click" vulnerability, meaning a phone can be infected without the owner opening a link or file, and that the attackers needed only the targets' phone numbers. According to that reporting, the officials believe the operation is almost certainly state-backed and that the spyware, which has not been named, is commercially developed and has been used by several governments before. No government or vendor has publicly confirmed that account.

A global wave, not a German one

Germany is not the only place where alerts landed. Apple's latest batch went to users in 99 countries, according to the notice received by Beirut-based filmmaker Radwan Mortada, who said on X that it warned Apple had detected "another attack against your device." He was previously targeted by spyware in 2021.

The new round brings the total to more than 150 countries since Apple began the program. Its previous major round, in August, covered 110 countries. Those figures describe where recipients are located, not confirmed infections.

John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab, said the latest batch again appeared significant. He urged recipients to turn on Apple's Lockdown Mode and to contact the digital rights group Access Now rather than firms selling paid fixes.

Natalia Krapiva, senior tech-legal counsel at Access Now, told CyberScoop that the volume of alerts shows "the fight against the scourge of spyware abuse is far from over." She said repressive states keep using these tools against civil society and opposition figures.

Governments are the customers

Governments rarely build these tools themselves. Many buy them from private vendors. The best known is Israel's NSO Group, which sells Pegasus. Germany's own federal criminal police, the BKA, reportedly bought access to Pegasus in 2019.

That history makes the German case awkward. The country now faces a suspected hack of its own lawmakers using a product category its own security services have bought.

Security researchers and rights groups also note that an Apple alert is a warning of targeting, not proof of a break-in. Whether any German device was actually infected is something forensic examination of the phones would have to settle. The BSI has not said whether such examinations are underway or what they have found.

Attribution remains unresolved. Berlin has not named a suspect, a vendor or a country, and Kornelius said only that investigators are working on it. Until that changes, the surveillance market sits behind a single unanswered question: who wanted the phone numbers of German officials badly enough to buy a zero-click exploit.