Germany’s Federal Office for Information Security (BSI) has warned members of the Bundestag and of the federal government that their iPhones may have been attacked with spyware. Digital Minister Karsten Wildberger confirmed it this weekend, according to ARD’s tagesschau. The warning follows Apple threat notifications that iPhones have received since 29 October.
Which politicians are affected is not public. This post sorts what is stated from what is open, then lists steps for anyone who may be a target.
What Is Confirmed About the Bundestag iPhone Spyware Warning?
According to ARD, Wildberger said Apple had reported that certain devices may have been compromised with so-called spyware. He said the BSI reacted quickly and wrote to everyone affected. The BSI letter, which ARD has seen, tells those affected to assume as a precaution that the device may be compromised. The BSI also writes that it has no further information on the cause of the notifications.
| Point | What ARD reports | What is still open |
|---|---|---|
| Who was warned | Members of the Bundestag and of the federal government, by letter from the BSI | Which politicians, and how many devices |
| Trigger | iPhones have received Apple threat notifications since 29 October | The cause behind the notifications |
| Spyware | Described as mercenary spyware in the BSI letter; no product name | Which product and which exploit |
| Success of the attack | Apple’s alert does not say whether the attack worked | Whether any device was actually infected |
| Attacker | Apple does not attribute attacks, and the minister gave no further detail | Who ran the campaign and why |
Apple’s support page explains the notification. Apple calls it a high-confidence alert that a user has been individually targeted by a mercenary spyware attack. Apple says these attacks are vastly more sophisticated than regular cybercriminal activity, cost millions of dollars, and hit a very small number of specific individuals. Per the BSI, such spyware can access messages including encrypted messengers, calls, contacts, calendar and location, and can switch on the microphone and camera.
What Should a High-Risk iPhone User Do Now?
Apple’s guidance for anyone with a threat notification is to verify it, turn on Lockdown Mode and seek expert help. The first three steps below follow Apple, and the last two are our advice.
- Verify the alertSign in at account.apple.com and look for the banner. Apple says its notifications never ask you to click links, open files, install apps or profiles, or share a password or code.
- Turn on Lockdown ModeOpen Settings, Privacy & Security, Lockdown Mode, Turn On, then restart. It must be enabled on each device; a paired Apple Watch follows.
- Get expert helpApple names the Digital Security Helpline from Access Now, available 24/7. Contact your security officer (our advice).
- Do not wipe first (our advice)A forensic examination needs the device state. Isolate it until your security team decides.
- Keep the basics on (our advice)Install every iOS update, use a strong passcode and two-factor authentication, and treat unexpected links and attachments as hostile.
Lockdown Mode is built for very few people. Apple says it blocks most message attachment types and link previews, restricts complex web technologies, and stops configuration profiles from being installed. Some websites will load slowly or break.
Why Does Mercenary Spyware Target Politicians?
Apple says it has sent such notifications since 2021 to users in over 150 countries, often to journalists, activists, politicians and diplomats. For background, read our entry on mercenary spyware.
A documented earlier case shows what a targeted infection looks like. Our record on Predator spyware used against an Egyptian opposition candidate covers it, and more cases sit in the incident library. We draw no link to the German warning.
What Is Still Unknown?
The spyware product, the attacker and the number of devices are not public. We will not speculate on attribution, and we name no lawmaker. If the BSI or Apple publishes technical detail, organisations should update first and then check their own high-risk staff.