Bundestag Spyware: Apple Warns German MPs and Ministers Their iPhones Were Targeted

A Bundestag spyware alert has put Germany’s political class on notice: members of parliament and of the federal government have received Apple warnings since Oct. 29 that their iPhones were targeted by “mercenary spyware,” Digital Minister Karsten Wildberger confirmed on Sunday, Nov. 1. Wildberger said on ARD’s “Bericht aus Berlin” that the notifications indicated certain devices “may have been compromised,” Anadolu reported.

The Federal Office for Information Security (BSI) wrote to everyone affected and advised them to “assume, as a precaution, that the device may have been compromised,” according to tagesschau. The government has not said how many people received alerts or who they are.

What the Bundestag spyware warnings say

Apple’s notices told recipients that an attack involving mercenary spyware had been detected against their devices. The BSI said it has “no further information regarding the specific cause or background of the notifications.” Wildberger said the agency “reacted super quickly,” declined to speculate on who might be behind it (“Das ist jetzt rein spekulativ,” he said) and said the reports “very much worry us,” according to Euronews.

The stakes are high because of what such tools can do. According to the BSI, as reported by heise online, attackers using this class of spyware can read messages, including those in encrypted apps, and access calls, contacts, calendars and location data. They can also switch on a phone’s microphone and camera.

Apple says on its threat notification support page that it has sent such alerts to users in more than 150 countries since 2021. It describes them as high-confidence warnings that a person was individually targeted, not proof that an attack succeeded. Apple does not attribute attacks to specific actors, and it had not commented on the German case. It recommends that targeted users turn on Lockdown Mode and seek help from digital security groups such as the Access Now helpline.

Key facts and history

Sources: CCDCOE Cyber Law Toolkit; Federal Office for the Protection of the Constitution (BfV); tagesschau; BSI via heise. Table: The Boston Report

Germany has been here before. The 2015 intrusion into the Bundestag network is documented in NATO’s CCDCOE cyber law toolkit, which records Germany’s attribution to APT28. In May 2024, the domestic intelligence agency said the same group ran a campaign from late 2022 that hit the Social Democrats as well as defense, aerospace and logistics companies, with a focus on targets linked to Russia’s war against Ukraine, according to the BfV.

No government or researcher has linked this week’s alerts to Russia or any other state. Mercenary spyware is sold commercially to governments, and past cases elsewhere have involved a range of buyers. Readers should treat any attribution as unconfirmed until officials or forensic researchers publish evidence.

Why it matters

A successful cyberattack on lawmakers’ phones would give an intruder a live view of coalition negotiations, committee work and private contacts at a time of intense debate in Berlin over defense, Ukraine and migration. The case also lands days after Germany’s new Federal Police Act took effect. And disinformation has been another front: EU monitors recently tied a fake German video to a Russian influence operation.

Three things to watch: whether the BSI or the Bundestag administration discloses how many devices were targeted, whether forensic analysis finds actual infections, and whether Berlin moves to attribute the operation, which would raise diplomatic pressure on whoever is responsible.

Sources

• Euronews: German MPs and ministers warned iPhones have been targeted by spyware
• tagesschau: Wildberger on hacker attack on Bundestag members
• heise online: BSI warning about spyware on politicians’ phones
• Anadolu: Hackers target German lawmakers’ and government officials’ devices
• Apple Support: About Apple threat notifications
• BfV: APT28 responsible for large-scale cyber campaign (May 2024)
• CCDCOE Cyber Law Toolkit: Bundestag Hack (2015)