Apple warns German lawmakers and officials their iPhones were targeted by spyware

The skim

• Members of Germany's Bundestag and federal government officials got Apple alerts that their iPhones may have been targeted by "mercenary spyware," Digital Minister Karsten Wildberger confirmed Sunday.
• Germany's cybersecurity agency, the BSI, told recipients to assume as a precaution that their phones may be compromised. It says it has no further information about the cause.
• Nobody has said how many people were notified or who is behind it. Apple hasn't commented.

What happened

Speaking on public broadcaster ARD's Bericht aus Berlin on Sunday, Wildberger said there had been "a notification from Apple that certain devices may have been compromised with so-called spyware," Euronews reports.

According to a letter from the Federal Office for Information Security (BSI), as reported by ARD, the iPhone alerts started arriving on Oct. 29 and said Apple had detected an attack involving "mercenary" spyware, Anadolu Agency reports. Wildberger said the BSI "reacted super quickly" and wrote to everyone affected about what to do. He didn't say how many politicians were notified or who they were.

The BSI recommended that recipients "assume, as a precaution, that the device may have been compromised," because Apple's alerts don't say whether an attack actually succeeded. "We currently have no further information regarding the specific cause or background of the notifications," the agency said.

The BSI says spyware of this kind can give attackers access to messages, including those in encrypted apps, as well as calls, contacts, calendars and location data, and can switch on a phone's microphone and camera.

What Apple's alerts mean

Apple sends threat notifications when it believes someone has been individually targeted by mercenary spyware, which it describes on its support page as attacks "vastly more sophisticated than regular cybercriminal activity" that "cost millions of dollars" and target "a very small number of specific individuals." Apple calls the alerts "high-confidence" and says it has notified users in more than 150 countries since 2021.

Apple doesn't attribute these attacks to any specific attacker or country, and it won't explain what triggers an alert, saying that could help attackers avoid detection. Its page notes that public reporting has historically tied attacks like these to state actors, including private companies that build spyware for them, such as NSO Group's Pegasus.

Why it matters

Lawmakers and ministers carry some of the most sensitive conversations in a country on their phones, and spyware that can read encrypted chats and switch on microphones turns those phones into listening devices. Apple's notifications don't confirm a breach, but Germany is treating them as if they could be one.

What to do if you get one

Most people will never see an Apple threat notification. If you do, Apple says real alerts appear on your iPhone's Lock Screen and in Settings, arrive by email from threat-notifications@email.apple.com, and show up as a banner when you sign in at account.apple.com. Apple says genuine alerts never ask you to click links, open files, install apps or profiles, or share your Apple Account password or verification code.

If you're notified, Apple recommends turning on Lockdown Mode and getting expert help, such as the Digital Security Helpline run by the nonprofit Access Now, which Apple says is available around the clock. For everyone else, Apple's standard advice applies: keep your devices updated and use two-factor authentication.

Sources: Euronews, Anadolu Agency and Apple Support.