This article may contain affiliate links. Learn more on our Partner Program page.
Since October 29th, a warning message has been appearing on the iPhones of members of the German Bundestag and government officials, a message Apple only sends in cases of targeted attacks. Apple reports a targeted attack using spyware, and the German Federal Office for Information Security (BSI) advises those affected to consider their devices compromised. The perpetrator(s) are unknown.
Federal Digital Minister Karsten Wildberger (CDU) confirmed on Sunday a report by the ARD's Berlin studio that mobile devices belonging to members of parliament and the federal government had allegedly been attacked. In the "Report from Berlin," he referred, according to tagesschau.de, to a notification from Apple that "certain devices may have been compromised with so-called spyware." He did not provide further details.
These warnings are part of Apple's threat notifications, which the company has been using since 2021 to warn users about so-called mercenary spyware. Apple last issued a warning to users in 110 countries in August.
Key Facts at a Glance
- Since October 29th, iPhones belonging to members of the German Bundestag and government officials have been receiving Apple's threat notification.
- Digital Minister Wildberger has confirmed the incident; according to him, the BSI has informed all those affected in writing.
- The BSI recommends assuming a compromised device as a precautionary measure.
- It is not publicly known how many politicians are affected and who carried out the attack.
What the BSI letter says
The ARD Berlin studio has received a letter from the Federal Office for Information Security (BSI). According to the letter, iPhones have been receiving a threat notification from Apple since October 29th, indicating that an attack using so-called mercenary spyware has been detected. The BSI states that it currently has "no further information" regarding the specific reason for this.
Apple's notification does not indicate whether an attack was actually successful. The German Federal Office for Information Security (BSI) therefore recommended that those affected "assume as a precaution that their device may be compromised." Which members of parliament or government officials received the warning has not yet been made public.
How Apple's warnings work
Apple describes the notifications in a support document on threat alerts as highly reliable warnings, even though its own investigations never achieve absolute certainty. These are attacks using mercenary spyware that specifically target individuals. According to Apple, it has notified users in more than 150 countries since 2021.
The warning appears on the iPhone's lock screen and in its settings. Apple also sends an email to the addresses associated with the Apple account, and a banner appears after logging in to account.apple.com. Apple does not disclose who carried out the attack.
The timing of this incident coincides with a new global wave. At the end of October, security researcher Costin Raiu published the text of a new Apple notification addressed to users in 99 countries.
| Period | Countries with notifications |
|---|---|
| total since 2021 | more than 150 |
| Wave August 2026 | 110 |
| Wave at the end of October 2026 | 99 |
Why the case goes beyond the Bundestag
According to the BSI (Federal Office for Information Security), attackers could use this to read messages from encrypted messaging apps, calls, contacts, calendars, and location data, as well as activate the microphone and camera. For members of parliament and government officials, this affects not only private data but potentially confidential communications.
The case is also noteworthy because German authorities themselves use spyware: in 2021, the Federal Criminal Police Office confirmed the use of Pegasus. Programs like Pegasus typically exploit unknown security vulnerabilities on the iPhone and can infiltrate the device without the victim's knowledge, which makes commercial spyware on the iPhone so difficult to detect.
What those affected and everyone else should do
I believe the BSI's recommendation is correct, precisely because the notification doesn't prove a successful attack. Anyone using a device for confidential communication shouldn't wait for certainty after receiving such a warning. Apple advises affected users to seek expert help and activate Lockdown Mode, which eliminates many attack vectors.
For most iPhone users, the risk remains low because these attacks target specific, selected individuals. Anyone who receives such a warning should check it directly at account.apple.com. According to Apple, a genuine threat notification will never ask you to click links, open files, install apps or profiles, or reveal your password or verification code. For everyone else, the basic rules of cybersecurity on the iPhone remain crucial: install updates promptly and protect your Apple account with two-factor authentication.
Do you think it's right that members of parliament should completely replace their iPhones after such a warning, or is blocking them sufficient? Let us know in the comments what action you would take in their situation.
