Apple warns German lawmakers of possible spyware attacks

Who is affected

According to Security Affairs↗ (opens in a new tab), several members of the German Bundestag (parliament) and other public figures received threat notifications from Apple starting on 29 October 2026. Germany’s digital minister, Karsten Wildberger, confirmed that both lawmakers and federal government members were among those warned. The government has not said how many people were targeted or named any individuals.

Apple reportedly sent similar warnings to users in 99 countries. One public case outside Germany is Beirut-based filmmaker Radwan Mortada, who said on X that he received an alert about a spyware attack.

How the attack worked

Apple’s notification warned about so-called mercenary spyware. This is commercial surveillance software, often sold to governments and used to target specific individuals. According to the German Federal Office for Information Security (BSI), such spyware can infect devices through “zero-click” attacks. In a zero-click attack, the victim does not need to open a message or click a link, the malware can install itself silently. Victims usually do not notice any signs of infection.

Once installed, this spyware can give attackers full access to the device. The BSI says attackers could read messages (even in encrypted apps), access calls, contacts, calendars and location, and even turn on the camera and microphone without the user’s knowledge.

The response

The BSI advised all those who received Apple’s warning to assume their device may have been compromised, even though it is not clear if the attacks succeeded or were only attempted. The BSI wrote to affected lawmakers on 30 October 2026, urging them to contact the agency and take several steps:

• Update the iPhone’s operating system immediately (unless a forensic analysis is planned).
• Consider turning on Lockdown Mode, a feature that restricts some functions to make attacks harder, though it does not remove an existing infection.
• If the risk is high, replace the device, reset all accounts used on it, change the phone number, set a new device passcode, and change passwords for Apple and email accounts.
• Enable two-factor authentication, Signal’s registration lock, and WhatsApp’s two-step verification with new PINs.
• Remove any linked devices you do not recognise.

The BSI and Apple have not said which government or group is behind the attacks. It is also unclear how many devices were actually compromised, as Apple’s alerts do not confirm a successful infection. Apple has not commented publicly on this incident, and the German government has not named any specific targets or said if the Chancellor was among them.