German officials say lawmakers' iPhones may be targets of spyware

Germany’s government has confirmed that members of the Bundestag and the federal government received warnings from Apple that their iPhones may have been targeted by spyware. Digital minister Karsten Wildberger confirmed it on Sunday on ARD, saying Apple had flagged that certain devices may have been compromised.¹

According to a letter from the federal cybersecurity office, the BSI, the alerts began arriving on October 29 and referred to an attack using “mercenary spyware”.¹ The BSI said other public figures also received them.² Nobody has said how many people were warned or who they are. Wildberger said the review was still under way as of Sunday evening.² A government spokesperson, Stefan Kornelius, said Berlin was taking the warning very seriously but would not say whether Chancellor Friedrich Merz was among those targeted.³

The warnings reached beyond Germany. Beirut-based filmmaker Radwan Mortada posted on X that he received a notice that Apple had detected “another attack against your device”, after he was targeted by spyware in 2021.³ That is his own account of his own notice. Apple’s notice to him said this round went to users in 99 countries.³ Who is behind the attacks, and which government may have ordered them, is not known.³²

What the notification means. Apple sends these alerts when it believes a user was individually targeted by mercenary spyware, which it calls far more sophisticated than ordinary criminal activity.¹ The warning appears on the lock screen and in settings, and also arrives by email.¹ Apple does not say whether an attack succeeded, and it does not name the party responsible.³ That gap is why the BSI tells recipients to assume the device may be compromised.³

The BSI says this class of spyware can read messages, including those in encrypted apps, as well as calls, contacts, calendars and location data, and can switch on the microphone and camera.¹ It often relies on “zero-click” exploits, which infect a phone without the owner tapping anything.³ For recipients, the BSI recommends setting up a new device with a new phone number and moving over only the data actually needed, skipping a full backup restore.²

For everyone else, Apple says the vast majority of users will never be targeted.¹ The attacks are costly and, per the BSI, mostly the work of state actors.² Seen it before: the vendor sends the alert, the government sends the memo, and the person holding the phone gets to wonder which of the two knows more.

The tools are sold, not home-built. Governments commonly buy them from private vendors, the best known being Israel’s NSO Group and its Pegasus software.³ Germany’s federal criminal police office, the BKA, reportedly bought access to Pegasus in 2019.³

What you should do. If you have not received a threat notification, nothing in these reports asks you to change anything. If you do get one, treat it as real and follow the BSI’s advice above.

Our read: The notice is a strong signal but not a verdict, because it says someone was targeted, not that the phone was breached. Until the BSI finishes its review, the open questions are how many devices were hit, whether any attack succeeded, and who is responsible. Plain disclosure from Berlin within days is the right shape for this; the missing names are the part to watch.

Footnotes

1. Euronews, “German MPs and ministers warned iPhones have been targeted by spyware”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. ZDF, “Spyware auf Regierungshandys: Minister Wildberger bestätigt Hack”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

3. TechCrunch, “Germany says lawmakers’ iPhones may have been hacked with spyware”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹