Apple has warned German government members and lawmakers that their iPhones may have been targeted by sophisticated spyware capable of secretly accessing cameras and microphones.
Germany's cybersecurity agency has urged recipients to treat their phones as potentially compromised, although officials have not confirmed whether any of the suspected attacks succeeded.
The threat notifications began reaching iPhones on 29 October 2026, according to a letter from Germany's Federal Office for Information Security (BSI) obtained by public broadcaster ARD.
Digital Minister Karsten Wildberger confirmed the warnings on 1 November and said the agency had contacted those affected.
The alerts reached Bundestag lawmakers, government members and other public figures. Authorities have not identified the recipients or disclosed how many devices were targeted.
Spyware Could Secretly Access Cameras and Microphones
The BSI said that mercenary spyware can give attackers access to private messages, calls, contacts, calendar entries and location information. If an iPhone is successfully infected, attackers may also be able to activate its camera and microphone without the owner's knowledge.
‼️ BREAKING: Apple has warned German MPs and ministers that their iPhones were targeted by mercenary spyware.The alerts started landing on 29 October, digital minister Karsten Wildberger confirmed.Germany's cyber agency BSI told every recipient to assume their phone may be compromised.
— International Cyber Digest (@IntCyberDigest) November 2, 2026
That could potentially expose confidential communications and conversations taking place near a compromised phone. However, German authorities have not reported that any cameras or microphones were activated in this case.
The agency also warned that sophisticated spyware can access messages exchanged through encrypted messaging services. End-to-end encryption protects messages while they travel between devices, but spyware installed on a phone may read them after they have been decrypted.
Another concern is the possibility of infection without any action from the victim. According to ZDF's reporting, the BSI explained that some attacks can exploit malicious messages that do not need to be opened. Such techniques are known as 'zero-click' attacks.
The specific vulnerability involved in the German case has not been publicly disclosed.
Germany Advises Recipients to Replace Their iPhones
The BSI has urged people who received Apple's warnings to assume their devices might already be compromised.
According to correspondence obtained by ZDF, the agency recommended setting up a new phone with a new telephone number. Recipients were also advised to transfer only essential information and avoid restoring a complete backup onto the replacement device.
The advice reflects the potential seriousness of the threat. It does not establish that spyware was successfully installed on any of the phones.
On 2 November, government spokesman Stefan Kornelius said Germany was treating the warnings seriously and that authorities were working to establish what had happened.
He said officials were supporting those affected but declined to identify the recipients, including whether Chancellor Friedrich Merz was among them.
What Apple's Spyware Warnings Actually Mean
Apple describes its mercenary spyware notifications as high-confidence warnings that an individual has been targeted by a sophisticated attack. Such operations typically involve significant resources and are directed at a relatively small number of people.
According to Apple's official security guidance, the company relies on internal threat intelligence to identify suspected attacks. It does not disclose the specific evidence behind a notification because doing so could help attackers avoid detection.
Importantly, receiving an alert does not prove that an attacker successfully gained access to a phone. It also does not establish that private messages, government documents or other sensitive information were stolen.
Apple advises recipients to verify warnings by signing in directly to their Apple Account, where genuine notifications appear. The company also recommends seeking expert assistance and enabling Lockdown Mode to strengthen protection against future attacks.
German authorities have not publicly identified the attackers, the spyware product or the precise method used in the suspected targeting. As of 3 November, they have also not announced whether any of the warned devices were successfully infected.
