Germany Says Lawmakers’ iPhones May Have Been Hacked With Spyware

Germany has warned members of parliament, government officials and other public figures that their iPhones may have been targeted by sophisticated spyware. The warning followed threat notifications issued by Apple, which indicated that certain devices may have been targeted by commercial surveillance software. Germany’s Digital Minister Karsten Wildberger confirmed the incident, while the country’s Federal Office for Information Security (BSI) advised recipients to treat their devices as potentially compromised.

The alerts began arriving on October 29, 2026, and the German government is investigating the circumstances of the suspected attack. The identities of the affected politicians, the number of devices involved and the organisation responsible have not been publicly disclosed. Importantly, Apple’s notification indicates that a person may have been targeted; it does not establish that the spyware successfully infected the device. The incident nevertheless raises concerns about the security of smartphones used by government officials and people with access to sensitive information.

Key Takeaways

• Germany confirmed that lawmakers and government officials received Apple spyware threat notifications.
• The alerts reportedly began arriving on October 29, 2026.
• The suspected attack involved commercially developed mercenary spyware.
• Germany’s BSI advised recipients to assume their devices could be compromised.
• The identities and number of affected individuals remain undisclosed.
• Investigators have not identified the attackers or confirmed whether infections succeeded.
• Reports indicate the attack may have used a zero-click vulnerability, although authorities have not publicly confirmed the technical details.
• Spyware of this kind can potentially access encrypted messages, calls, contacts, location information and device sensors.

What Happened to German Lawmakers’ iPhones?

The incident came to light after Apple sent security notifications to people whose devices it believed had been targeted by sophisticated spyware.

According to reporting by German broadcaster ARD, the BSI issued a written warning to affected individuals after receiving information about the Apple alerts.

Germany’s Digital Minister Karsten Wildberger subsequently confirmed the reports during an appearance on ARD’s Bericht aus Berlin. He said Apple had notified authorities that certain devices may have been compromised using spyware.

The BSI responded by informing known recipients and providing security guidance.

Government spokesperson Stefan Kornelius said the federal government was taking the incident seriously and that authorities were working to investigate the circumstances and support affected individuals.

However, officials have not disclosed which members of parliament or government officials received the warnings. It is also unclear whether Chancellor Friedrich Merz was among those targeted.

What Is Mercenary Spyware?

The suspected software belongs to a category commonly called mercenary spyware.

Unlike ordinary malware distributed through mass phishing campaigns, mercenary spyware is typically developed by specialised commercial companies and sold to government customers or other organisations.

These tools are designed to secretly monitor selected individuals, often people with access to sensitive information.

One of the best-known examples is Pegasus, developed by Israeli surveillance technology company NSO Group.

Depending on the software and vulnerability involved, spyware can potentially give attackers access to:

• Private messages, including conversations on encrypted messaging applications.
• Phone calls and contact lists.
• Photographs, documents and other stored files.
• Location information and movement history.
• Calendar entries and personal information.
• Microphone and camera functions.

This makes mercenary spyware particularly concerning when politicians, journalists, diplomats, lawyers or other high-profile individuals are targeted.

Did Hackers Successfully Infect the iPhones?

The distinction between being targeted and being successfully hacked is important.

Apple’s threat notifications are designed to alert individuals when the company believes they may have been specifically targeted by mercenary spyware.

However, the notification does not necessarily confirm that an attacker successfully installed surveillance software on the device.

Apple generally does not disclose the technical details behind individual notifications or publicly identify the suspected attackers.

The BSI has therefore advised affected individuals to act cautiously and assume their devices may have been compromised until the situation is clarified.

According to reporting by the Financial Times, the suspected operation involved a zero-click vulnerability. Such attacks can compromise a device without requiring the victim to click a malicious link, download an attachment or install an application.

The report said attackers needed only the targets’ phone numbers. However, the precise vulnerability and exploitation method have not been publicly confirmed by Apple or German authorities.

Why Is a Zero-Click Spyware Attack Dangerous?

Traditional cyberattacks often depend on tricking users into opening malicious links, downloading infected files or entering their credentials on fraudulent websites.

Zero-click attacks work differently.

They exploit weaknesses in software that can be triggered when a device automatically processes certain incoming data. A successful attack may therefore happen without the user taking any visible action.

For example, a vulnerability in a messaging service or another system component could potentially allow attackers to execute malicious code when a device receives specially crafted information.

This makes zero-click attacks particularly difficult for individuals to avoid through ordinary cybersecurity awareness.

Even cautious users who avoid suspicious links and regularly update their applications can remain potential targets if their devices contain an exploitable vulnerability.

What Security Measures Has Germany Recommended?

The BSI has advised people who received Apple’s notifications to treat their devices as potentially compromised.

According to German broadcaster ZDF, the agency recommended that affected individuals move to a new device and use a new phone number.

The guidance also recommends transferring only essential information to the replacement device rather than restoring a complete backup. This reduces the possibility of transferring compromised data or software-related problems to the new phone.

Apple threat notifications should also be taken seriously. Users who receive one can verify it through Apple’s official threat notification guidance rather than relying on suspicious messages or links claiming to provide security information.

Apple provides information about these alerts through its support documentation:

Apple Support: About Apple threat notifications and spyware attacks

The German government has not publicly released a complete technical report explaining the attack or all recommended recovery procedures.

Who Is Behind the Spyware Attack?

At present, the identity of the attackers remains unknown.

The Financial Times reported that security officials believe the operation was almost certainly state-backed. However, no government or specific hacking group has been publicly identified as responsible.

Commercial spyware companies often sell their products to multiple customers, making it difficult to establish who authorised a particular operation.

Germany has experienced several significant cyberattacks involving political institutions.

In 2015, hackers associated with Russia’s military intelligence service compromised the German parliament’s computer systems. The attack resulted in the theft of approximately 16 gigabytes of data.

In 2022, a Russian-linked hacking group targeted Germany’s Social Democratic Party.

More recently, German lawmakers were also affected by a separate campaign targeting Signal messaging accounts.

These incidents illustrate the continuing cybersecurity risks facing political institutions. However, there is currently no confirmed evidence linking the latest iPhone spyware warnings to those earlier attacks.

Apple Has Sent Spyware Warnings Beyond Germany

The German incident appears to be part of a broader wave of Apple security notifications.

TechCrunch reported that Apple’s latest notifications reached users in 99 countries.

The recipients were not limited to politicians or government officials. Other individuals, including people involved in journalism and civil society, also reported receiving warnings.

Apple has a dedicated threat notification system because commercial spyware attacks are highly targeted and difficult to detect through conventional security measures.

The company says such attacks are significantly more sophisticated than ordinary cybercriminal activity and that the vast majority of its users will never be targeted by them.

Apple does not publicly identify the customers of commercial spyware companies or disclose the full technical details of each investigation.

The Bigger Picture

The incident highlights how smartphones have become important targets in international intelligence and surveillance operations.

For government officials, a compromised phone can expose more than personal information. It may provide access to confidential conversations, sensitive contacts, travel movements and communications involving other public officials.

The growing availability of commercial spyware has also changed the cybersecurity landscape. Governments and other customers can potentially acquire sophisticated surveillance capabilities from private companies rather than developing their own tools.

This creates challenges for technology companies, security agencies and regulators trying to prevent the misuse of powerful surveillance software.

Looking Ahead

German authorities are continuing to investigate the notifications and determine whether any devices were successfully compromised. Identifying the affected individuals, the technical vulnerability and the organisation behind the operation will be important steps in understanding the scale of the incident.

For Apple, the episode again demonstrates the importance of its threat notification system and investment in device security. For governments, it reinforces the need for stronger protections around the smartphones and communications systems used by people handling sensitive information.