Several members of Germany’s Bundestag have received iPhone spyware warnings from Apple since October 29, 2026, according to the country’s Federal Office for Information Security, the BSI. The agency says it does not know whether any phone was actually compromised, and it tells every recipient to assume theirs may have been.
Apple’s iPhone Spyware Warnings Reached German Lawmakers From October 29
In a November 2026 advisory, the BSI says several Bundestag members and other public figures received a threat notification on their Apple devices saying Apple had detected an attack using mercenary spyware. The BSI defines that as commercially developed surveillance software that has often been used on behalf of state actors against selected individuals, with NSO Group’s Pegasus as the best-known example. The agency says it wrote to Bundestag members on October 30 to explain the risk and the steps they needed to take, and asked anyone affected to contact it directly. TechCrunch’s Zack Whittaker reported that government spokesperson Stefan Kornelius, speaking to the Financial Times, did not say who in the federal government had been targeted.
The Notification Says a Person Was Targeted, Not Whether the Attack Worked
The BSI says Apple calls its threat notifications very reliable warnings that a person has been deliberately targeted, and Apple does not attribute attacks to any government. The BSI notes that the alert cannot tell the recipient whether the attack succeeded. It also explains why a recipient may have no other clue: this class of spyware typically infects a phone through a crafted message that never has to be opened, and victims usually notice nothing. Once a phone is compromised, the BSI says, attackers can read messages, including those in encrypted messengers, and reach calls, contacts, calendar, location, camera and microphone. Given an alert that is reliable about targeting and silent about outcome, the agency resolves the doubt toward compromise. TechCrunch reported that Apple’s latest batch of notifications went to users in 99 countries, citing a notice received by Beirut-based filmmaker Radwan Mortada.
The BSI Says to Update at Once Unless a Forensic Analysis Is Planned
The advisory’s first instruction carries a condition. Recipients should update the operating system immediately, unless they intend to have the device forensically examined. Updating can close the hole an attacker used, and it can also erase evidence of how they got in. Next, the BSI recommends turning on Lockdown Mode, keeping it on permanently, carrying it over to any new device, and installing future updates right away. It is explicit that Lockdown Mode makes new attacks harder and does nothing to remove an infection already present. The mode restricts message attachments, link previews and FaceTime calls from unknown contacts, while phone calls and plain text messages keep working.
High-Risk Recipients Are Told to Replace the Phone and Rebuild Every Account
Where a recipient judges the risk of compromise to be high, the BSI says to consider replacing the device, resetting every account used on it, and changing the phone number. On the new device, it recommends a new passcode different from the old one, new passwords for the Apple account, email and other accounts, and two-factor authentication everywhere. It says to set up authenticator apps fresh with each service instead of transferring them from the old phone. It also recommends Signal’s registration lock and WhatsApp’s two-step verification with new PINs, and a review of linked devices in both apps and in the Apple account. To spot fakes, the BSI says a genuine Apple notice appears on the lock screen and in Settings, arrives by email, and shows at the top of account.apple.com, and that Apple never asks recipients to click links, install profiles or share codes.
Why This Matters for Engineering Leadership
The BSI advisory is a ready-made incident runbook for the phones of your executives, founders and anyone who holds production credentials. Its hardest step is the first one. Updating destroys the evidence that forensics needs, so someone in your organization must decide, before the alert arrives, who makes that call and how quickly a forensic provider can take the device. Write that down now. The rebuild steps also expose a dependency most security plans skip. If a senior engineer’s authenticator app, SSO push approvals and on-call paging all live on one phone, a spyware alert on that phone is an alert on your production access. The BSI’s advice to re-enroll authenticators from scratch rather than migrate them only works if your identity provider supports fast, verified re-enrollment for the people who matter most. Test that flow with your on-call leads. And consider making Lockdown Mode standard for the small group whose devices would be worth a state actor’s effort, since the BSI tells recipients to keep it on permanently once enabled.
FAQ
Who received the iPhone spyware warnings in Germany?
Germany’s BSI says several members of the Bundestag and other public figures received Apple threat notifications from October 29, 2026. The government has not said which officials were targeted.
Does an Apple threat notification mean my iPhone was hacked?
Not necessarily. Apple says the notification means you were targeted, and it does not say whether the attack succeeded, so the BSI advises recipients to assume the device may be compromised.
What does the BSI tell people who get an Apple spyware warning?
Update the operating system immediately unless a forensic analysis is planned, turn on Lockdown Mode and keep it on, and consider replacing the device and changing the phone number if the risk is high.
Who is behind the spyware attacks on Bundestag members?
No one has been identified. Apple does not attribute attacks to specific governments, and TechCrunch reported that the latest batch of notifications went to users in 99 countries.
Does Lockdown Mode remove spyware from an iPhone?
No. The BSI says Lockdown Mode makes new attacks harder but does not remove an existing infection.
How can I tell a real Apple threat notification from a fake one?
The BSI says a genuine notice appears on the lock screen and in Settings, arrives by email and shows at the top of account.apple.com, and never asks you to click links or share codes.