Germany Warns Lawmakers That Their iPhones May Have Been Hacked With Spyware

Germany's federal cybersecurity agency is telling members of parliament and other prominent figures that they may have been targeted by government-grade spyware, after Apple quietly began notifying victims that their iPhones could have been compromised.

The agency, known as the BSI, said over the weekend that it had learned several members of the Bundestag and other unnamed notable individuals had received Apple's warning. The company periodically sends these alerts to people it believes may have been targeted by spyware capable of pulling messages, location history, and other sensitive data off a phone. Much of this spyware relies on zero-click exploits, meaning a victim doesn't have to tap a malicious link or open a suspicious file to get infected. The attack simply happens.

German government spokesperson Stefan Kornelius told the Financial Times that Berlin was "taking the incident and the warning very seriously." He declined to say which officials had been targeted, and wouldn't confirm or deny whether Chancellor Friedrich Merz was among them.

Apple's notifications come with a built-in ambiguity that makes situations like this hard to pin down. The company doesn't say which government or group is responsible for an attack, and it doesn't confirm that a device was actually broken into, only that it detected signs consistent with a targeted spyware attempt. The BSI addressed that gap directly, telling recipients that anyone who gets one of these alerts "should therefore assume that their device may have been compromised."

That uncertainty is by design, in a sense. Apple's threat notification system is built to flag likely targeting without turning the company into an arbiter of geopolitical attribution. The tradeoff is that victims, and the governments responsible for protecting them, are left to assume the worst and investigate on their own.

Germany isn't the only place where this round of notifications landed. Radwan Mortada, a filmmaker based in Beirut, posted on X that he'd received a new alert warning of "another attack against your device," years after he was targeted by spyware back in 2021. According to the notice Mortada received, Apple's latest wave of warnings went out to users across 99 countries, suggesting this isn't an isolated campaign aimed at one country's political class but something with a far wider reach.

Who's behind it, and who's buying

Nobody has identified the party responsible for this specific wave of attacks. That's typical. Attribution in spyware cases usually takes months of forensic work by security researchers, if it happens at all, and Apple itself stays out of the naming game entirely.

What is clear is how this kind of surveillance typically gets built and sold. Governments rarely write their own spyware. Instead, they buy access from private companies, often described as "mercenary spyware" vendors, that develop the hacking tools and license them to state clients. The most prominent name in that business is Israel's NSO Group, maker of the Pegasus spyware that has been linked to surveillance of journalists, activists, and officials around the world.

Germany's own history with this industry adds an uncomfortable wrinkle to the current story. The country's federal police agency, the BKA, reportedly purchased access to Pegasus back in 2019. That means the same government now warning its lawmakers about potential spyware targeting has, in the past, been a customer of the kind of tool capable of carrying out exactly this sort of attack.

The incident is a reminder that the spyware market doesn't sort neatly into attackers and defenders. The same capabilities marketed to governments as law enforcement or national security tools are the ones showing up in attacks against parliamentarians and journalists. As Apple's notifications keep surfacing new rounds of targeting, the harder question, who ordered this one and why, remains open. For now, Germany's lawmakers are left in the same position as everyone else who got the alert: assuming the worst until proven otherwise.