Germany warns Bundestag members their iPhones may have been targeted by state-backed spyware

Germany's federal cybersecurity agency has told members of parliament and other public figures that they were targeted by government-backed spyware, according to TechCrunch. The warning came days after Apple began sending notifications to people it believed may have been attacked through their iPhones.

What the BSI disclosed

In a note issued over the weekend, the BSI, Germany's federal cybersecurity office, said it had learned that members of the Bundestag and other unnamed prominent individuals had received Apple alerts about possible targeting, TechCrunch reports.

Citing the Financial Times, TechCrunch adds that government spokesperson Stefan Kornelius said Berlin is treating both the incident and Apple's warning seriously, while declining to say which federal officials were affected, including whether Chancellor Friedrich Merz was among them.

How Apple's threat notifications work

Apple periodically sends these alerts to users it suspects may have been targeted by spyware capable of stealing messages, location data and other sensitive information from a phone. Much of this software relies on zero-click exploits, which can compromise a device without the victim tapping a link or opening a file, making the intrusion nearly invisible.

The notifications have limits, though. Apple does not attribute attacks to specific governments and does not confirm whether a phone was actually breached. For that reason, TechCrunch reports, the BSI advised anyone who receives an Apple notification to assume their device may have been compromised.

A wave that reached well beyond Germany

The latest round of alerts was not confined to German officials. According to a notice received by Radwan Mortada, a Beirut-based filmmaker, this batch of Apple notifications went out to users in 99 countries. Mortada said in a post on X that Apple warned him of a fresh attack against his device, years after spyware targeted him in 2021.

Who is behind the campaign, and which government if any orchestrated it, remains unclear, TechCrunch notes.

The mercenary spyware market behind it

The episode again highlights the murky industry behind a growing number of attacks on members of civil society. Governments rarely build these tools themselves, TechCrunch explains; most buy them from private vendors often described as mercenary spyware makers, the best known being Israel's NSO Group, which sells the controversial Pegasus spyware.

Germany has its own stake in that market. According to TechCrunch, the country's federal criminal police agency, the BKA, reportedly purchased access to Pegasus in 2019.

Why it matters

The phones of sitting legislators are among the highest-value intelligence targets that exist, holding private messages, schedules, contacts and location histories that could expose sources, political negotiations and state business. Zero-click spyware makes this threat especially hard to counter, because user caution around links and attachments provides no defense at all.

The BSI's advice to treat an Apple notification as presumptive evidence of compromise also underlines how little certainty even the platform can offer recipients. And with this wave reaching users in 99 countries while Germany's own police have bought the same class of tool, the episode shows how thoroughly commercial spyware has blurred the line between attacker, customer and victim.