By 
Germany’s government has confirmed that iPhones used by members of the Bundestag, federal officials and other public figures received Apple warnings about a suspected mercenary spyware campaign. The alerts began arriving on 29 October, and authorities are investigating who was targeted and whether any devices were successfully compromised.
Digital Minister Karsten Wildberger acknowledged the incident on public broadcaster ARD, while the Federal Office for Information Security (BSI) advised recipients to treat their devices as potentially compromised. Officials have not disclosed the number of people affected, identified the spyware or named a suspected operator.
What German officials have confirmed
Wildberger confirmed that Apple had notified certain users that their devices may have been targeted with spyware. The BSI subsequently contacted people who received alerts and issued precautionary guidance. The warnings were reported on iPhones from 29 October, according to information cited by German media.
At a government press conference on 2 November, a spokesperson said the authorities were taking the warnings seriously and working to establish the circumstances. The government declined to identify potentially affected ministers or say whether Chancellor Friedrich Merz had received an alert. Officials also stressed that the investigation had not yet established the full extent of the incident.
The distinction matters: an Apple threat notification is a high-confidence indication that a person was individually targeted, but it does not by itself prove that the attempted attack succeeded. German authorities have therefore advised recipients to assume their phones may be compromised while the investigation continues.
Why the suspected spyware is especially concerning
The BSI described the software as commercially developed spyware of the kind that has frequently been used on behalf of state actors against carefully selected individuals. Such tools are often called “mercenary spyware” because governments or other clients can obtain them from private surveillance vendors.
German officials said they believe the devices may have been infected without any action by their owners. This is consistent with a zero-click attack, in which an exploit can compromise a device without the target opening a link, downloading a file or approving an installation. The authorities have not publicly identified the vulnerability or technical delivery method involved in this case.
If a phone is successfully compromised, spyware can potentially expose messages—including conversations in encrypted messaging apps—along with calls, contacts, calendars and location data. It may also allow an attacker to activate the device’s microphone or camera. The precise capabilities of the software involved in the German incident have not been disclosed.
The best-known commercial spyware example is Pegasus, developed by NSO Group. However, there is no public evidence that Pegasus was used in this incident. It would be premature to identify a vendor, government or country as responsible.
What Apple’s warning does—and does not—mean
Apple says its threat notifications are intended to alert people it believes have been individually targeted by highly sophisticated mercenary spyware. The company describes these alerts as high-confidence warnings, while noting that its investigations cannot provide absolute certainty. Apple does not publicly disclose the technical indicators behind individual notifications or attribute attacks to particular governments or geographic regions.
That means the alert should not be dismissed as an ordinary security pop-up, but it should also not be reported as proof that a phone has been infected. In Germany’s case, the BSI’s advice is precautionary: recipients should behave as though their devices may be compromised until specialists can assess the situation.
How the authorities are responding
The BSI has contacted known recipients and offered guidance. At the government press conference, officials said people who received an Apple threat notification could contact the BSI for advice. The agency recommended that affected individuals move to a new device and phone number as a precaution, transfer only essential data and avoid restoring a complete backup that could carry compromised material across.
Apple separately recommends that anyone who receives a threat notification take it seriously, verify the alert by signing in directly to account.apple.com, enable Lockdown Mode and seek expert security assistance. Apple says genuine threat notifications do not ask recipients to click links, install profiles or disclose passwords or verification codes.
For most users, Apple says these highly targeted attacks are rare. It recommends keeping devices updated, using strong passcodes and two-factor authentication, and installing apps only from trusted sources. Those general steps are useful, but they are not a substitute for specialist incident response when a person has received a targeted spyware warning.
Investigation leaves key questions unanswered
Several central details remain unknown: how many German officials and public figures were targeted, whether any devices were successfully infected, which spyware platform was involved and who commissioned the operation. Authorities have not attributed the activity to a state or disclosed a confirmed motive.
The warning adds to a wider pattern of cyber risks facing European institutions and businesses. Spire News has also reported on cyberattacks disrupting supermarket refrigeration systems across Europe. The incident puts a spotlight on the security of smartphones used for government communications. A successful compromise of even a small number of senior officials’ devices could expose sensitive conversations, contacts and movements. The investigation will need to establish whether the alerts reflect attempted intrusions, confirmed infections or a combination of both.
For now, the confirmed story is narrower than some early headlines suggest: Apple warned selected users of suspected mercenary spyware targeting, Germany’s government acknowledged the warnings and the BSI is assisting recipients. The identity of the attacker and the outcome of the attempts remain unconfirmed.
