German federal ministers and members of the Bundestag have been targeted by mercenary iPhone spyware attacks, Germany’s digital minister confirmed on Sunday. Apple began issuing threat notifications directly to affected politicians on 29 October, prompting Germany’s cybersecurity agency to advise officials to treat their phones as compromised.
Key points
- Apple issued threat notifications to German lawmakers and cabinet members warning of targeted mercenary spyware.
- Digital minister Karsten Wildberger confirmed the warnings following advice from the Federal Office for Information Security.
- Security officials instructed those affected to assume their devices are breached, though infection success remains unconfirmed.
- Authorities have not identified who deployed the surveillance tools or how many politicians received warnings.
Warnings sent to the Bundestag
Karsten Wildberger, Germany’s digital minister, confirmed the security alerts during an appearance on ARD‘s Bericht aus Berlin. Wildberger said there had been “a notification from Apple that certain devices may have been compromised with so-called spyware”.
The alerts reached devices across Germany’s federal government and parliament. Wildberger cited an official letter from the Federal Office for Information Security, known as the BSI, which confirmed the notifications started arriving on 29 October. Neither the ministry nor the BSI disclosed the exact number of lawmakers affected, nor did they reveal the identities of targeted officials.
How mercenary spyware operates
Apple threat alerts inform users when company telemetry indicates an attack by private surveillance software. In Apple’s threat notification documentation, the manufacturer explains that mercenary spyware tools cost millions of pounds and specifically target select individuals rather than the general public.
The alerts appear on an iPhone’s lock screen, within the system settings menu, and arrive simultaneously via email to the Apple Account linked to the device. Apple designs the warnings to notify users whose profiles suggest state-linked or highly funded surveillance actors have singled them out.
According to technical details shared by the BSI, successful spyware intrusions provide attackers with sweeping control over an infected phone. Attackers can read private messages sent across encrypted communication apps, intercept voice calls, view contact lists, inspect calendars and track physical location data. The surveillance software can also silently activate an iPhone’s microphone and camera to monitor the device’s surroundings.
The response from German cyber authorities
German cyber defence officials intervened once Apple delivered the warnings. Wildberger said the BSI “reacted super quickly” after the alerts appeared, sending guidance directly to every recipient.
The BSI told all targeted individuals to operate under the assumption that attackers successfully breached their devices. Apple’s threat detection mechanisms identify intrusion attempts, but the alert itself cannot verify whether the targeted device resisted the exploit or succumbed to it. Taking a device out of active use or treating it as hostile prevents further data leakage while digital forensics specialists examine the hardware.
Attribution remains unresolved
German authorities have not named the state or commercial contractor responsible for the campaign. Commercial surveillance firms routinely sell zero-click mobile exploits to intelligence and law enforcement agencies worldwide, masking the origin of specific operations.
Neither Apple nor the BSI has pointed to specific threat groups or foreign governments. Forensics teams at the BSI continue to examine the targeted hardware to establish whether the exploit payloads managed to execute on the devices.
