Germany warns lawmakers their iPhones may have been hacked with commercial spyware

Germany's government said on Monday that members of the Bundestag and of the federal cabinet may have had their iPhones hacked with commercial spyware. Apple began sending threat warnings to the devices on October 29. Germany's federal cybersecurity agency, the BSI, then told lawmakers to assume their phones could be compromised.

Officials have not said who is behind the attack, how many people were targeted, or which ministers received warnings. They also do not know yet whether any phone was actually infected.

On the same day, the Left Party's parliamentary group said its members' Bundestag email accounts had been flooded with tens of thousands of spam messages. The Bundestag press office called it a "highly skilled spam attack." Officials have not linked the two incidents.

What the BSI says happened

The BSI, the Federal Office for Information Security, set out what it knows in a notice on its website. The quotes from German sources in this story are our translations.

The agency said that "several members of the German Bundestag as well as other public figures" had received a threat notification from Apple since October 29. In it, Apple said it had detected an attack with what it calls "mercenary spyware."

The BSI described such tools as "commercially developed, advanced spyware that in the past has often been used on behalf of state actors against individual, specifically selected persons." Its best-known example, the agency said, is Pegasus, made by the Israeli firm NSO Group.

The BSI said it does not know whether the warnings mean phones were actually compromised or only that someone tried. But it said this kind of spyware usually infects a phone with no action by its owner. A prepared message that is never opened can be enough. This is known as a "zero-click" attack. Victims usually notice nothing.

Once a phone is compromised, the BSI said, attackers can read messages, including those in encrypted messaging apps. They can also reach calls, contacts, calendars and location data, and switch on the microphone and camera.

The agency wrote to members of the Bundestag on October 30 to warn them and explain what to do. It announced the warnings publicly on Monday in a post on its Mastodon account.

What the government said

Digital Minister Karsten Wildberger, a member of Chancellor Friedrich Merz's Christian Democrats, confirmed the warnings on Sunday. He spoke on the ARD public broadcaster's Sunday program "Bericht aus Berlin."

There was "a report from Apple that certain devices may have been compromised with so-called spyware," Wildberger said. The tech news site heise online reported his remarks, citing ARD and the dpa news agency. He said the BSI had "reacted super fast" and written to everyone affected.

He would not go further. "It is purely speculative right now what this specifically is about. We have to wait and see," he said. He said he would not necessarily blame the attack on artificial intelligence, since spyware on phones has existed for a long time. "It is nevertheless something that of course worries us greatly," he added.

On Monday, government spokesman Stefan Kornelius said the government was taking the incident "very seriously," Der Tagesspiegel reported, citing dpa and AFP. He said the BSI warning and its advice had been made public early "because it must be assumed that devices may be compromised."

Kornelius said no public statement could be made about which members of the government were affected. He said the authorities were working hard to find out what had happened and to support those affected, and that protective measures would be developed further. TechCrunch reported, citing the Financial Times, that he did not say whether Merz was among those targeted.

A spokeswoman for the Interior Ministry, led by Alexander Dobrindt, said private individuals had also received the warnings. A spokesman for the digital ministry stressed that an Apple warning by itself "says nothing about whether a compromise has actually occurred," according to the Tagesspiegel report.

What Apple's warnings mean

Apple sends these alerts when it believes a user has been singled out by a mercenary spyware attack. It explains how in a support document.

The company says such attacks "cost millions of dollars and often have a short shelf life." It says they are aimed at "a very small number of specific individuals," often "journalists, activists, politicians, and diplomats." It calls its notifications "high-confidence alerts," but says its investigations "can never achieve absolute certainty."

Apple says it has sent these alerts several times a year since 2021, to users in more than 150 countries in total. It does not say who is behind the attacks. "Apple does not attribute the attacks or resulting threat notifications to any specific attackers or geographical regions," the document says.

The latest round was not limited to Germany. TechCrunch reported that Radwan Mortada, a filmmaker based in Beirut, posted on X that he had received a new warning. According to the notice he received, Apple said this batch went out to users in 99 countries.

A genuine alert appears on the iPhone's lock screen and in its settings, and is also sent by email. Apple says real alerts never ask users to click links, install apps or give out passwords. Users can check whether an alert is genuine by signing in to their Apple account page.

What lawmakers were told to do

The BSI told anyone who received a warning to update their phone's operating system at once, unless they want a forensic check first. It also urged them to consider turning on Lockdown Mode, an iPhone setting that blocks some features, such as message attachments and link previews, to make attacks harder. Lockdown Mode does not remove an existing infection, the agency noted.

Those who think the risk is high should consider replacing their phone, the BSI said. That would include resetting all accounts used on the old device and changing their phone number. It also told them to change passwords, turn on two-step verification, and check Signal and WhatsApp for linked devices they do not recognize. It asked people who received an alert to tell the agency, to help it judge the scale of the attack.

Spam flood hits the Left Party

A separate attack on Monday targeted the Left Party, known in German as Die Linke. Ina Latendorf, a parliamentary manager for the party's Bundestag group, said her colleagues' inboxes had been flooded. "About 20,000 emails reached me," she told the Frankfurter Rundschau. She said the same was true for every other member of the group.

The accounts run on the Bundestag's own systems. The Bundestag press office confirmed "a highly skilled spam attack on the email accounts of Left Party members of parliament by various senders," the paper reported. It did not say who might be behind the campaign. The parliament's administration is in close contact with the BSI.

Latendorf said the emails came from senders in several countries, which made them hard to block with spam filters. She said no other parliamentary group had been hit. The Left Party's Bundestag group is co-led by Heidi Reichinnek.

Not the first attack on German politicians

German politicians have been targeted before. This spring, attackers used phishing messages on the Signal messaging app to target public figures, especially politicians, military officers and journalists, the Frankfurter Allgemeine Zeitung reported. Bundestag President Julia Klöckner was among those affected, the paper said.

After that wave, the Bundestag decided to rely less on Signal and move toward other services, the FAZ reported. "We are in a threat situation in which we should prefer a European provider for reasons of sovereignty alone," Bundestag Vice President Andrea Lindholz of the Christian Social Union said at the time. The paper said international intelligence services blamed Russia for that wave of attacks, as part of hybrid warfare against Germany.

The FAZ also noted that the Social Democratic Party was hit by a Russian hacking attack in 2023. The government has set up a program called "CyberGovSecure" with the BSI to strengthen digital security in the federal administration.

As in the spring, it is not clear whether the attackers obtained any data this time. Neither Apple nor German officials have said who might be responsible.

Germany has itself been a customer of the spyware industry. TechCrunch noted that the Federal Criminal Police Office, the BKA, reportedly bought access to Pegasus in 2019. The latest attack puts that debate back in view. It also comes as Berlin pushes for more control over its own technology, a goal Merz's government set out at its Digital Summit.

The European debate over spyware

The European Parliament spent a year investigating the use of Pegasus and similar tools inside the EU. In June 2023 it adopted a recommendation by 411 votes to 97, with 37 abstentions, according to the Parliament's press office. It said the illicit use of spyware had put "democracy itself at stake."

The Parliament did not call for a ban. It said spyware should be allowed only in exceptional cases, for a set purpose and a limited time, with judicial approval and independent oversight. It also said data belonging to politicians, doctors, lawyers and the media should be shielded from surveillance unless there is evidence of a crime.

Jeroen Lenaers, the Dutch Christian Democrat who chaired the inquiry, said spyware "can be an effective tool in fighting crime." But he said it is "a huge risk to the rule of law and fundamental rights" when governments use it wrongly. "Instead of banning spyware," he said, the EU should make sure member states meet requirements such as judicial approval and independent oversight.

Digital rights groups wanted more. European Digital Rights, a network of civil society groups, had urged an EU-wide ban. In its response, it said the inquiry had "missed the chance to draw this vitally important red line." It argued that finding and exploiting security flaws, and carrying out hacks, "should not be outsourced to the private sector, domestic or foreign."

What comes next

The BSI and the federal government are still investigating. Officials have not said when they will say more about the number of people targeted or who was behind the attack. The Bundestag administration is working with the BSI on the spam attack against the Left Party.

For background on the parties in the Bundestag and the issues dividing them, see our Germany issues guide and our German elections page.

This story is based on the BSI's public notice, Apple's published guidance, statements reported by German news outlets, and reporting by TechCrunch, the Frankfurter Allgemeine Zeitung and the Frankfurter Rundschau. Read how we handle sources in our methodology.

Differing perspectives

Should European governments be allowed to buy and use commercial spyware?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• Allow it only under strict safeguards

  Who holds it: The European Parliament majority that adopted the 2023 Pegasus inquiry recommendation, including inquiry chair Jeroen Lenaers

  Spyware can be an effective tool against serious crime, but misuse by governments threatens the rule of law and fundamental rights. Rather than a ban, EU rules should allow it only in exceptional cases, for a set purpose and limited time, with judicial approval, independent oversight, notice to people targeted and protection for politicians, lawyers, doctors and journalists.

  In their words: European Parliament ↗

• Ban commercial spyware outright

  Who holds it: European Digital Rights (EDRi), a network of digital rights groups

  The most intrusive spyware cannot meet the tests of necessity and proportionality, so no safeguard can fix the harm it does to privacy. Governments have used it against journalists, activists and rights defenders. The EU should ban such tools and stop supporting an industry that sells hacking to states, because hacking should not be outsourced to private firms.

  In their words: European Digital Rights (EDRi) ↗