Germany Says Lawmakers' iPhones May Have Been Targeted With Spyware
Germany's Federal Office for Information Security (BSI) said it had become aware that members of the Bundestag and other unnamed notable individuals had received warnings from Apple that they may have been targeted by cyberattacks, according to TechCrunch.
Government spokesperson Stefan Kornelius said the government in Berlin was taking the incident and the warning very seriously. He did not identify who in the federal government had been targeted, and did not say whether Chancellor Friedrich Merz was among them.
The BSI said iPhones in Germany have been receiving Apple threat notifications since Oct. 29, each warning that a spyware attack had been detected, as Anadolu Agency reported. The BSI's guidance is that anyone who receives an Apple threat notification should assume their device may have been compromised. The Financial Times reported that the iPhone attack affecting German politicians exploited a so-called zero-click vulnerability, meaning a software flaw that works without any action from the target, much like a burglar who gets through a door nobody knew was unlocked.
Apple does not attribute threat-notification attacks to specific governments, and it does not say whether a recipient's phone was actually compromised. The company describes the notifications as high-confidence alerts that a user has been individually targeted by mercenary spyware, meaning commercial intrusion software built by a private firm and sold to clients. Apple says it relies solely on its internal threat-intelligence information and investigations to detect such activity.
The notices are not confined to Germany. Beirut-based filmmaker Radwan Mortada said he received a new Apple threat notification warning that Apple had detected "another attack against your device." An earlier spyware attack had targeted him in 2021. Apple said its latest batch of threat notifications went out to users in 99 countries. The company has sent them multiple times a year since 2021 and says it has notified users in over 150 countries in total. An earlier round, reported in December 2025, was issued on Dec. 2.
On the device, an alert appears on the Lock Screen and in Settings. Apple also sends an email to the addresses associated with the user's Apple Account, and a banner appears at the top of account.apple.com after sign-in. The notifications recommend protective steps, including enabling Lockdown Mode, a setting that restricts certain features to shrink the attack surface. They also advise recipients to enlist expert help, such as the rapid-response emergency assistance offered by Access Now's Digital Security Helpline. Apple states that Lockdown Mode helps protect devices against extremely rare and highly sophisticated cyber attacks.
Apple cites Pegasus from the NSO Group as an example of mercenary spyware developed by a private company on behalf of state actors. Apple's own support material says such attacks cost millions of dollars and often have a short shelf life, which makes them harder to detect and prevent.
The broader context here is the distinction between a targeting signal and a verdict. By Apple's own description, a threat notification means a user was individually targeted, not that the device was breached. For officials whose communications carry national weight, that gap is where the practical work sits: deciding whether to enable Lockdown Mode, bringing in forensic specialists, and checking whether a device was compromised. The notification pipeline, which reaches users through the device, email and the account website, gives targets a way to act early.
