Apple’s threat notifications about mercenary spyware reached German ministry staffers, lawmakers and journalists, according to Der Spiegel, and Germany’s cybersecurity agency told recipients to assume their devices are infected. Apple says victims are located in 99 countries.
Der Spiegel Reports Warnings Reached the Merz Delegation
Der Spiegel reported on Monday, November 2, that Apple sent threat notifications to ministry staffers, lawmakers and journalists who traveled with Chancellor Friedrich Merz on an Asia trip that included South Korea, Japan and Singapore. Apple sent the notifications late last week, around October 30.
On Tuesday, November 3, Green Party co-leader Franziska Brantner, a member of the European Affairs Committee, said she was a recipient. MEP Hannah Neumann said several foreign-policy politicians and staffers were included in this round of notifications.
Journalists Were the First to Confirm Publicly
A Lebanese documentary filmmaker and a Turkey-based reporter were the first people to publicly confirm that they had received the warnings. Their cases show that the notifications went beyond German government circles. Apple says the targets are in 99 countries, which puts the German recipients inside a much larger group.
BSI Tells Recipients to Replace Their Devices
Germany’s Federal Office for Information Security, the BSI, sent officials and public figures a letter within 24 hours of Apple’s notices. According to Digital Minister Karsten Wildberg, the letter tells recipients to assume their devices are infected and to replace them immediately.
That guidance is stronger than a typical advisory. Telling people to treat devices as compromised and swap them out reflects the agency’s judgment about the risk of mercenary spyware, which is built to run quietly on a phone and access data without the owner’s knowledge.
What the BSI Cannot Yet Say
The BSI does not know how many devices were actually infected as opposed to targeted. It also does not know why these particular people were chosen. Those gaps matter: a threat notification from Apple indicates that a device or account was targeted, not necessarily that an attack succeeded.
No Spyware Vendor Has Been Named
The sources do not attribute the campaign to a specific spyware vendor. Apple’s notifications use the general category of mercenary spyware, which refers to sophisticated surveillance tools sold to government customers. Without a named vendor or customer, the identity of whoever ordered the targeting remains unknown.
The timing and the people involved give the case weight in Germany. The recipients include staff who were traveling with the head of government, and members of a parliamentary committee on European affairs. For a government, the possibility that a foreign actor was watching ministry staff during a trip is a national-security concern, and that concern is the context for the BSI’s quick letter.
The scale across 99 countries is unclear. Apple has said victims are spread widely but the sources do not provide a total number of people notified or a breakdown by country. The German cases are the ones that have been named publicly, which reflects press attention in Berlin rather than necessarily the proportion of the global total.
Analysts of earlier spyware cases have noted that targeting often clusters around political and journalistic work, and the roster here, which includes foreign-policy politicians and reporters, fits that general pattern. This is a general observation rather than a finding in the German case, since no one has publicly identified the operator.
Next Steps for German Officials and Other Recipients
The guidance from the BSI is to replace devices immediately. For others who receive an Apple threat notification, the notice itself is the signal that a targeting attempt has been detected. The open questions are who is behind the campaign and how many of the German devices were infected. The BSI has said it does not yet have those answers, so the picture will depend on forensic work by the agency and by those who received the warnings.
