Quick Summary
- Germany’s BSI says members of the Bundestag and other public figures received Apple warnings about possible spyware targeting.
- Apple’s notifications do not identify the suspected government or confirm that a device was successfully compromised.
- The latest alerts reportedly reached users in 99 countries, according to a person who received one.
Germany’s government is warning politicians and public figures to take Apple spyware notifications seriously after members of parliament received alerts that their iPhones may have been targeted. TechCrunch reported the development on November 2, citing Germany’s Federal Office for Information Security and comments from government spokesperson Stefan Kornelius. The authorities have not identified who was behind the activity or confirmed that every device that received an alert was successfully compromised.
What a recipient should do
- Preserve the Apple threat notification.
- Follow Apple’s security guidance and update the device.
- Use a separate trusted device to seek expert advice if the phone handles sensitive work.
- Review account sessions and access to sensitive services.
- Contact the relevant security authority or employer response team.
What the German authorities know
The BSI said it had become aware that members of the Bundestag and other notable individuals had received Apple warnings about possible cyberattacks. Kornelius told the Financial Times that the government was taking the incident and the warnings very seriously. He did not say which officials were targeted or whether Chancellor Friedrich Merz was among them. The government has not publicly attributed the activity to a specific country or spyware vendor.
Apple periodically sends threat notifications to people it believes may have been targeted by sophisticated attacks. The company does not generally identify the government or organisation responsible, and the alert does not necessarily mean that a device was successfully compromised. The BSI nevertheless advised recipients to assume that their devices may have been affected and to take the warning seriously. That approach reflects the potential sensitivity of the information held on the phones of public officials.
Why spyware alerts are difficult to interpret
Commercial spyware can collect messages, location data and other information from a targeted phone. Some tools use so-called zero-click exploits, which can compromise a device without the user opening a link or file. That makes the attacks difficult for ordinary users to detect. The market for surveillance tools includes private vendors that sell products to governments and law-enforcement agencies, but the existence of such a market does not identify who carried out a particular operation.
Apple’s notification system aims to warn people when the company believes they may have been targeted. It is not a public attribution report or a complete forensic analysis of the device. Recipients should preserve the notification, follow Apple’s security guidance and seek expert help if they handle sensitive information. The BSI’s warning is particularly relevant to lawmakers and public figures because their devices may contain confidential communications, contacts and access to government services.
A wider pattern beyond Germany
The latest round of notifications reportedly reached people in 99 countries. One recipient outside Germany said the alert referred to another attack against his device after a previous spyware incident in 2021. Those reports show that the targeting is not confined to one national parliament, although they do not establish that every recipient faced the same attacker or technique.
The incident renews questions about how governments regulate commercial surveillance tools and what protections are available to journalists, politicians and civil-society groups. Germany itself has previously been linked to the purchase of Pegasus spyware for law-enforcement use, according to reporting cited by TechCrunch. The current warnings do not prove that Pegasus or any particular vendor was involved. Investigators will need technical evidence before they can make that determination.
Apple’s notifications are designed for a small group of people who may be targeted by sophisticated attackers, not as a general warning that every iPhone is unsafe. Recipients should avoid forwarding sensitive material from a device they believe may be compromised and should follow official guidance rather than installing unknown security applications. Employers and government offices may also need to review whether a targeted person’s accounts or devices connect to wider networks. The public information does not identify the attacker or confirm the compromise of every device, so attribution should remain open until technical evidence is available.
The BSI has not publicly attributed the suspected activity to a particular government or spyware supplier. Apple’s notification is a warning of possible targeting, not proof that every recipient’s phone was compromised. Investigators will need device-level evidence before making a reliable attribution. Public officials should preserve alerts and follow their organisation’s incident-response process.