Germany Warns Lawmakers And Ministers After Apple iPhone Spyware Instances

Germany has warned members of its parliament and federal government about possible spyware attacks targeting their Apple iPhones. The warnings follow security notifications from Apple, raising concerns about unauthorized access to sensitive communications and government information.
 

While German authorities have acknowledged the potential cyberattacks, it remains unclear how many officials were targeted, whether their devices were successfully compromised, or who was responsible.
 

Here's what happened.
 

TL;DR

 

• German lawmakers and government officials received Apple notifications warning of suspected mercenary spyware attacks.
• Apple's alerts reportedly began reaching affected iPhones on October 29, 2026.
• Germany's cybersecurity authority advised recipients to treat their devices as potentially compromised.
• The number of affected devices, attackers' identities, and success of the attempted intrusions remain unknown.

Germany Confirms Potential Spyware Attacks On Politicians' iPhones

Germany's Federal Minister for Digital Transformation and Government Modernization, Karsten Wildberger, confirmed that members of the Bundestag and federal government had received warnings concerning possible spyware attacks on their Apple devices.

Source

According to reporting by Euronews, Wildberger acknowledged the development during an appearance on German broadcaster ARD's Bericht aus Berlin on November 1.

The minister said Apple had notified authorities that certain devices might have been compromised by spyware, prompting Germany's Federal Office for Information Security (BSI) to respond.

Wildberger said the BSI acted quickly and contacted affected individuals with guidance on handling the potential security threat.

According to ARD, which obtained a copy of the BSI's communication, Apple began sending threat notifications to affected iPhones on October 29, 2026.

These notifications indicated that Apple had detected suspected mercenary spyware attacks against the devices.

The BSI advised recipients to assume, as a precaution, that their devices could have been compromised, even though the notifications did not establish whether the attacks had succeeded.

The authority also acknowledged that it lacked detailed information about the specific circumstances surrounding the alerts.

Apple Spyware Warnings Raise Concerns Over Sensitive Government Data

The potential attacks have raised concerns because mercenary spyware can allow attackers to monitor personal communications and obtain sensitive information from targeted devices.

As explained by TechCrunch, this category of surveillance software is commonly associated with sophisticated, highly targeted cyberattacks against politicians, journalists, activists, and other prominent individuals.

Such attacks can sometimes exploit security vulnerabilities without requiring users to click suspicious links or download malicious files, making them particularly difficult to identify.

According to Euronews, successful spyware infections could potentially expose messages, including communications through encrypted messaging applications, alongside call information, contacts, calendars, and location data.

Advanced spyware can also enable attackers to activate a device's microphone or camera.

These capabilities make potential infections especially concerning for government officials who may use their devices for sensitive political or administrative communications.

However, the German authorities have not publicly confirmed that any specific information was stolen or that an individual device was successfully infected.

Apple Threat Notifications Do Not Confirm Successful Hacking

Apple issues threat notifications when its security systems identify indications that a user has been individually targeted by mercenary spyware.

According to Apple's official support documentation, these attacks are substantially more sophisticated than ordinary cybercriminal activity and often involve significant resources.

The company also emphasizes that the overwhelming majority of users will never encounter such attacks.

Apple's warning system can notify affected individuals through device notifications, email, and alerts associated with their Apple Account.

Importantly, receiving a warning does not automatically establish that an attacker successfully accessed the device.

Apple also does not publicly identify the attackers responsible for individual threat notifications, citing the risk of revealing information that could help them evade future detection.

Meanwhile, TechCrunch reported that the recent wave of notifications extended beyond Germany.

The publication highlighted a notification received by Beirut-based filmmaker Radwan Mortada, who said Apple had alerted him about another suspected attack against his device.

According to the notification he shared, Apple's latest round of alerts reached users across 99 countries.

However, that figure refers to the wider notification campaign and does not establish how many individuals were affected in Germany or how many devices were successfully compromised.

What Should iPhone Users Do After Receiving Spyware Alerts?

Apple advises individuals who receive genuine mercenary spyware notifications to take them seriously and seek appropriate security assistance.

Users can verify the authenticity of a notification by signing in directly to their Apple Account rather than following suspicious links or responding to unsolicited messages.

Apple also recommends enabling Lockdown Mode, an optional security feature designed to reduce exposure to highly sophisticated digital attacks.

 

Keeping devices updated with the latest available software and seeking expert support are additional precautions for individuals who believe they may have been specifically targeted.

For German politicians who received the latest alerts, the BSI has already issued guidance advising them to treat their devices as potentially compromised.

The investigation's scope remains uncertain.

As of November 3, 2026, German authorities had not publicly disclosed the number of affected officials, the identities of the attackers, or evidence confirming that the suspected spyware attacks had succeeded.

The incident highlights the continuing cybersecurity risks faced by government officials and other high-profile individuals, even when they use devices equipped with advanced security protections.