Apple warns German MPs and ministers their iPhones were targeted by spyware

Apple has warned members of the German Bundestag and the federal government that their iPhones may have been targeted with commercial spyware. Germany's Digital Minister Karsten Wildberger confirmed the warnings on Sunday, November 1, on ARD's political talk show "Bericht aus Berlin", after tagesschau.de reported on a letter from the Federal Office for Information Security (BSI) to those affected. Apple had told the government that "certain devices may have been compromised with so-called spyware", Wildberger said.

What the BSI letter says

According to the letter, which the ARD Berlin studio has seen, iPhones began receiving Apple threat notifications on October 29. The notifications said Apple had detected an attack with "mercenary spyware", Apple's term for commercial surveillance tools sold to governments, such as NSO Group's Pegasus. "We currently have no further information on the specific cause and background of the notifications," the BSI wrote.

A notification does not show whether an attack succeeded. The BSI therefore advised recipients "to assume as a precaution that the device may be compromised". Wildberger said the agency had reacted very quickly and contacted everyone affected in writing. He called the reports worrying but gave no further details and said it was too early to say what kind of attack it was, heise online reported.

What is still unknown

The government has not said how many politicians received a warning, which parties they belong to, or whether any phone was actually infected. Nobody has been named as the attacker. Apple does not explain what triggers a notification and does not attribute attacks to specific actors, and it did not comment on the reports, Euronews noted.

According to the BSI, spyware of this kind can read messages, including those in end-to-end encrypted messengers, as well as calls, contacts, calendars and location, and can switch on the microphone and camera. Some of these tools install themselves without the owner tapping anything, through flaws in the phone's software.

If Apple sends you a threat notification

Apple says it sends these alerts only when it has high confidence that a specific person was targeted, usually because of who they are or what they do. It adds that the vast majority of users will never be targeted this way. According to Apple, a genuine alert appears in three places: on the Lock Screen and in Settings, by email from [email protected], and as a banner at the top of the page when you sign in at account.apple.com.

• Check that it is real: Apple never asks you to click a link, open a file, install an app or profile, or share your password or a code. A sender address can be forged, so sign in at account.apple.com yourself rather than trusting the email. If there is no banner there, treat the message as fake.
• Turn on Lockdown Mode: Settings, Privacy and Security, Lockdown Mode. It blocks most message attachments, some web technologies and unknown incoming FaceTime calls, which closes common routes for spyware. The phone restarts after you enable it.
• Get expert help: Apple points recipients to the Digital Security Helpline of the nonprofit Access Now, which works around the clock.
• Keep the basics in place: install iOS updates promptly, use a passcode, two-factor authentication and Stolen Device Protection.