Apple Warned German Officials Their iPhones May Be Hacked by Spyware

November 3 — Germany’s digital affairs minister, Karsten Wildberger, confirmed on 1 November local time that Apple has sent security warnings to some government staff and members of parliament, indicating their devices may have been compromised by spyware.

Germany’s Federal Office for Information Security (BSI) has told those who received the warnings to take protective measures on the assumption that their devices may already have been compromised.

According to a German television report yesterday, Apple has been notifying affected iPhone users since 29 October 2026 that their devices may be targets of so-called “mercenary spyware”.

In an interview on ARD’s “Bericht aus Berlin”, Wildberger said Apple had informed the German government that some devices may have been attacked with spyware. He said the BSI responded quickly and has written to everyone known to have received an Apple warning.

As of publication, the German government has not said how many people received the warnings, nor disclosed their names or departments. A government spokesperson also would not say whether Chancellor Friedrich Merz was among the targets.

In its notice to those affected, the BSI said the specific reason for Apple’s warning and the background to the attack are not yet clear. Because Apple’s threat notifications do not prove an attack succeeded, the agency advised recipients to assume for safety that their devices may have been compromised.

According to the BSI, once such spyware infects a device, attackers may bypass its existing protections to read messages — including in encrypted communication apps — obtain call, contact, calendar and location data, and even switch on the microphone and camera without the user’s knowledge.

The BSI also noted that such attacks usually involve highly sophisticated commercial spyware, and that state actors are among the main forces behind them. Pegasus, developed by Israel’s NSO Group, is one example. German officials have not attributed this incident to any country or organisation, nor confirmed which specific software was used.

The Financial Times reported on 2 November that security officials believe state involvement is almost certain, though the identity of the operators has not been made public. The report also said the attacks used a “zero-click” method, in which attackers may need only the target’s phone number — no malicious link to tap, no file to open.

People outside Germany have also received recent Apple threat alerts. Beirut-based filmmaker Radwan Mortada posted on X that he had received a new notification warning that Apple had detected “another attack targeting your device”, after a spyware attack in 2021. According to the notice he received, Apple said its latest batch of threat notifications had gone to users in 99 countries.