The German government is investigating a cyberattack targeting iPhone devices belonging to Bundestag lawmakers and federal government officials, following Apple threat notifications that warned certain devices had been compromised by mercenary spyware. The attack, which occurred around October 29, illustrates the growing vulnerability of politicians in Western democracies to the increasingly lucrative industry of digital espionage tools.
The discovery began when the Federal Office for Information Security (BSI, Bundesamt für Sicherheit in der Informationstechnik) noticed that several members of the Bundestag and German public figures had received threat notifications from Apple. These notifications are sent when Apple identifies evidence that a user has been targeted in a specific attack using commercially developed spyware designed for intelligence and espionage activities.
Federal Digital Minister Karsten Wildberger (CDU) publicly confirmed the reports on ARD, acknowledging the attack occurred and stating that an investigation was underway. "This is something we naturally view with concern," Wildberger told ZDFheute. "Unfortunately, this has happened before."
The BSI issued a detailed warning over the weekend, advising affected users to assume their devices were compromised. The agency recommended that all affected individuals contact the BSI directly. On October 30, the agency sent an informational letter to all Bundestag members, alerting them to the danger and outlining recommended security measures.
According to the BSI, the attack used "zero-click" techniques, meaning the malicious messages did not need to be opened or interacted with by the user to infect the device. "Those affected generally don't notice anything," a BSI spokesperson said. Once infected, the spyware can bypass all device security barriers, access messages — including those in encrypted messaging apps —, call contacts, track location, activate cameras and microphones without the owner's knowledge.
What makes this case particularly concerning is that while Apple sends this type of notification in multiple countries, this time a significantly higher number of German politicians appear to have been targeted. Apple confirmed to Heise that the notifications were sent on October 29, but said it would not provide details about the identity of the attackers or the exact type of spyware involved. The company also emphasized that while the notifications are highly reliable as indicators of a targeted attack, they do not confirm whether the attack was successful or whether data was effectively exfiltrated.
It remains unclear whether German Chancellor Friedrich Merz or other high-ranking ministers were among those affected. Federal government spokesperson Stefan Kornelius told the Financial Times that the government was "taking the incident and the warning very seriously," but did not specify who was among the targets.
Mercenary spyware refers to commercially developed espionage software sold primarily to governments and intelligence agencies. The Israeli NSO Group, maker of the controversial Pegasus, is the most well-known company in the sector, but there are several other suppliers, including France's Cybellum and U.S.-based companies. These software packages are extremely expensive — previous reports estimate a single license can cost hundreds of thousands of dollars — suggesting the attackers are likely nation-states with substantial cyberoperations budgets.
The case raises important questions about digital security in democratic governments. Germany itself has an ambiguous relationship with mercenary spyware: the BKA (Federal Criminal Police Office) purchased access to Pegasus in 2019, as revealed by Forbidden Tech. The purchase was later contested by human rights organizations and brought before the German Parliament, which held hearings on the use of spyware by law enforcement authorities.
Apple sent similar threat notifications across 150 countries, affecting users in 99 nations in this round, which was the second in less than a year — the first occurred in August. In previous rounds, Apple also warned about attacks on journalists, activists, and political figures around the world, including in Mexico, Brazil, India, and European countries. The fact that the company never discloses exactly which threats it identified or which spyware vendors were involved leaves affected users with few options beyond assuming the worst and replacing their devices.
The BSI investigation is ongoing. The agency has not yet disclosed estimates of the exact number of compromised devices, nor has it identified the group or state responsible for the attack. To date, BSI specialists have been unable to determine the specific origin or context of the notifications.
The case reinforces a worrying trend: as digital espionage becomes more sophisticated and accessible to state actors, democratic governments themselves become vulnerable targets. For parliamentarians dealing with sensitive issues — from cybersecurity investigations to decisions about artificial intelligence regulation — the possibility of private communication being compromised is not merely a threat to individual privacy, but a systemic risk to democratic governance.
The question is whether, in a world where even the chancellor can have a spyable iPhone, Western democracies are prepared to protect their own decision-makers from an industry that generates billions and grows without effective oversight.
Sources: Heise Online, ZDFheute, Der Spiegel
✓ Independent sources cross-checked and verified before publishing
