- Apple started sending spyware alerts to German ministers and lawmakers on October 29, and Germany’s cyber agency indicated the recipients’ iPhones may be hacked.
- The alerts show that someone was targeting these phones. They do not prove the attack worked, and no one has named the attacker.
- Officials tell recipients to update their iPhones, turn on Lockdown Mode, and think about getting a new phone.
Apple has warned members of Germany’s parliament and federal government that spyware may have hit their iPhones.
Digital Minister Karsten Wildberger reportedly confirmed the alerts on Sunday. Since then, Germany’s cyber agency has told every recipient to treat the phone as hacked.
Details of the Apple Threat Alert
According to Germany’s Federal Office for Information Security, the BSI, the alerts began on October 29. Wildberger discussed the case Sunday on the public broadcaster ARD.
He said Apple had reported that certain devices may have caught spyware. The BSI then wrote to everyone affected. Its letter to Bundestag members carries the date October 30. The agency also posted a public notice.
Many details remain secret. Wildberger did not say how many people got an alert. He also did not name them. Government spokesman Stefan Kornelius said Berlin takes the warning very seriously, according to a Financial Times report. However, he would not say whether Chancellor Friedrich Merz got one.
Implications of the Alert
Apple sends these alerts when it thinks someone has singled out a user for “mercenary spyware.” Private companies make this software. They mostly sell it to governments. Apple says it is far more advanced than ordinary criminal hacking.
The company describes the alerts as high-confidence warnings. Still, an alert does not show whether the attack worked. The BSI says it does not know either. So the agency tells recipients to assume the worst.
That caution makes sense. According to the BSI, this kind of spyware can read messages, even in encrypted chat apps. It can also see calls, contacts, calendars, and location. In addition, it can switch on the camera and microphone.
The Financial Times reports that the attack used a “zero-click” flaw. In other words, a phone can catch the spyware without the owner touching anything. The paper says the attackers needed only a phone number.
Who is Behind the Spyware?
Neither Apple nor the German government has pointed fingers at anyone yet. Apple, in fact, never calls out specific attackers or countries when it sends these alerts. Also, the spyware itself is still not named.
Still, Germany’s BSI notes that governments have a history of using this kind of software to go after their targets. At least one report says security officials are almost certain a state is behind it, though nobody’s confirmed that for sure.
German politicians know what it’s like to be in the crosshairs. Just this spring, a phishing attack targeted Signal users and hit several dozen lawmakers, with Bundestag President Julia Klöckner as the most high-profile target.
Years earlier, in 2015, Russian military hackers made off with around 16 gigabytes of data from the Bundestag. Germany officially blamed Russia in 2020. So far, though, there’s no evidence connecting those incidents to what’s happening now.
A Wider Wave of Alerts
Germany is not alone. Alerts have reached users in 99 countries since October 29. That number comes from alert text that people posted online. Apple has made no public statement about this round. It also had not commented on the German cases, according to Euronews.
Germany has also raised concerns about broader cybersecurity weaknesses, recently warning companies that most websites lack proper security contact files, which help security researchers report vulnerabilities responsibly.
Beirut-based filmmaker Radwan Mortada posted his notice on X. He says spyware also targeted him in 2021. By comparison, Apple’s last big round reached 110 countries on August 13. The company has sent such warnings since 2021.
Advice from the BSI Officials
The BSI gives recipients a clear list of steps. First, update iOS right away. The one exception is a phone that experts plan to examine. Second, turn on Lockdown Mode. This will make it harder for new attacks to succeed, but it won’t remove already installed spyware.
Third, replace your phone with a new one if the risk looks high. Then reset every account you used on the old one. The agency also suggests a new phone number. Next, set a new passcode and change your Apple account and email passwords. After that, turn on two-step sign-in. Finally, switch on Signal’s registration lock and WhatsApp’s two-step check. Remove any linked devices you do not know.
Recipients can also email the BSI Service Center. That helps the agency count how many people got alerts. Apple also points recipients to the Digital Security Helpline, run by the group Access Now. It offers expert help around the clock.
Nevertheless, be aware that some alerts are false, so verify information before taking action. An authentic alert from Apple will never ask you to click on any links, share passwords, or download anything. To confirm one, sign in at account.apple.com. A real notice shows at the top of the page.
Kornelius says officials are working hard to investigate and to help those affected. Key questions remain. How many people got alerts? Did any attack work? Who ordered it? For now, nobody has answers.
Apple says most people will never face an attack like this. Still, anyone who thinks they could be a target can turn on Lockdown Mode.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Germany’s Charité Hospital Breach Exposes Names and Emails of 140,000 People
Hackers attacked the Charité webpage server and stole confidential information, including the names ...
Apple iOS 27 Child Safety Features Spark Unverified Surveillance Claims in Australia
Social media posts say Apple and Google now spy on private messages, video calls and photos in Austr...
Lazarus Group Targets South Korea in New Spy Campaign Using Post-Quantum Encryption
Kaspersky links a new spy campaign called Operation FlashHole to North Korea’s Lazarus Group. ...
Signal, Windscribe Threaten Exit Over Canada’s Six-Month Metadata Rules
Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of t...
Hacker Claims Nearly 208,000 OpenRouter API Keys Are for Sale
A malicious individual has announced he is selling an OpenRouter database containing nearly 250,000 ...
Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware
Researchers found a campaign called DeadTag that abuses abandoned ad and analytics domains to send v...
