Germany's federal cybersecurity agency, the BSI, said over the weekend that members of the Bundestag and other prominent individuals had received a new round of Apple "threat notifications," warning they may have been targeted by mercenary spyware. Apple said the latest wave reached users in roughly 99 countries, a separate and more recent round than an August wave that hit about 110 countries worldwide.
German government spokesperson Stefan Kornelius said Berlin is "taking the incident and the warning very seriously," though he declined to say whether Chancellor Friedrich Merz was among those targeted. The notifications do not identify an attacker, and Apple does not publicly attribute the attacks — a deliberate policy the company has followed since it began issuing threat notifications in 2021, in part to avoid tipping off spyware vendors to the detection methods it uses.
How the notifications work
Apple's threat-notification system flags accounts it believes have been individually targeted with sophisticated, state-sponsored-style spyware, as distinct from the mass data breaches that generate routine security alerts. According to research from the Citizen Lab, which has tracked the notifications since they began, recipients have included journalists, human rights defenders, opposition politicians and, increasingly, government officials in countries not typically associated with surveillance scandals. Radwan Mortada, a Beirut-based filmmaker previously targeted by spyware in 2021, said on social media that he had received a new notification citing "another attack against your device," illustrating how some individuals are targeted repeatedly over years.
NSO Group, maker of the Pegasus spyware, remains the best-known commercial vendor in this space, though Apple's notifications do not name any specific company. Notably, Germany's own federal police agency, the BKA, purchased access to Pegasus in 2019, underscoring that the market for such tools includes democratic governments as both targets and customers — a tension that has complicated European efforts to regulate the industry.
A problem institutions haven't solved
The latest wave is a reminder that commercial spyware continues to proliferate even in countries with well-resourced cybersecurity agencies and legal protections for lawmakers. Germany's BSI has not said how many Bundestag members were notified or whether any device has been confirmed compromised; Apple's own support documentation notes that a notification indicates a high-confidence detection of targeting, not necessarily a successful compromise.
What happens next is, by design, murky: neither Apple nor German officials are expected to name a suspected attacker, and there is no public enforcement mechanism that automatically follows a threat notification. Advocacy groups are likely to use the episode to renew calls for the European Union to tighten rules on the sale and use of commercial spyware within the bloc — a debate that has gained little traction despite repeated scandals involving lawmakers and journalists in Greece, Poland, Spain and now, apparently, Germany.
