Apple threat notification: 5 honest facts

On 2 November 2026, tagesschau reported that Karsten Wildberger, Germany's digital minister, had confirmed an ARD report. In Bericht aus Berlin he said Apple had reported that certain devices may have been compromised with spyware. He said the federal cyber agency had written to the people affected.

The agency's own page is plainer, and it is the better source. The Federal Office for Information Security, the BSI, says several members of the Bundestag and other public figures have, since 29 October 2026, received a manufacturer threat notice on Apple devices. Apple told them it had detected an attack with mercenary spyware.

1. The notices began on 29 October 2026. They are not a published list of names.
2. The BSI wrote to Bundestag members on 30 October 2026.
3. An Apple threat notification does not show whether the attack succeeded.
4. Apple does not name an attacker, or a country, for these notices.
5. A figure of 99 countries for this round is not in the sources opened for this report. Apple's UK page gives a different, older total.

The BSI page is dated by the events it describes, not by a clock time on the page. It says the office learned that several Bundestag members and other public figures had received the Apple notice since 29 October 2026. On 30 October 2026 it wrote to members of the Bundestag, warned them, and set out steps. People who received a notice were asked to contact the BSI directly.

The important sentence is the one about certainty. The BSI says it does not know whether these notices mean a device was actually compromised, or only that an attack was attempted. It still tells a person who received the notice to assume that the device may have been compromised.

That is a precaution, not a forensic finding. tagesschau, which says it has seen the BSI letter, reports the same limit: the notice does not show whether the attack succeeded, and the BSI wrote that it had no further information on the occasion or the background.

Euronews, published on 2 November 2026, reports that Wildberger did not say how many politicians received the alerts, or who they were. The BSI's public page says "several" members and other public figures. Neither source publishes a count. A count that is not published should not be invented.

The BSI describes mercenary spyware as commercially developed spy software, often used in the past by state actors against individually chosen people. It says this class of software is generally assumed to infect a device without the person having to open a message. People usually notice nothing.

If a device is compromised, the BSI says an attacker can reach messages, including those inside encrypted messenger services, and also calls, contacts, calendar, location, camera and microphone. That is a description of capability after a compromise. It is not a finding that any named phone in this round was reached.

This report does not describe how such software is built, delivered or hidden. Those details are not needed to read the notice, and they are not in the public German documents as a method. The public question is narrower: Apple says it detected an attack. The BSI says it cannot yet say the attack worked.

Wildberger's television confirmation is real, and it is limited. tagesschau says he confirmed ARD's information in Bericht aus Berlin. Euronews dates that appearance to Sunday, which was 1 November 2026. He described an Apple message that certain devices may have been compromised with spyware. He said the BSI had written to those affected.

He did not, in the reports opened here, name the people, the number, the attacker, or a successful infection. tagesschau says he gave no further detail and was concerned about the reports. Concern from a minister is news. It is not a technical conclusion.

The BSI page and the minister's broadcast therefore agree on the shape of the event and disagree, slightly, on tone. The page says the office does not know if the notices mean compromise. The broadcast, as reported, used "may have been compromised". Both leave the success of any attack unproven.

The BSI tells a person who received the notice to update the operating system at once, if no forensic analysis is planned, and to consider Apple's Lockdown Mode to make later attacks harder. The link it gives is Apple's own Lockdown Mode page. Apple's German threat-notice page also points recipients to that mode, and to expert help.

Lockdown Mode is a setting Apple offers. Turning it on is not evidence the phone was clean, and leaving it off is not evidence the phone was taken. The BSI's sentence is a precaution for people who already have the notice. It is not a finding about everyone else in Germany.

Apple also points some recipients to Access Now's helpline. As that organisation's own page says, the helpline is for civil society, and Access Now has no special view into why Apple sent the Apple threat notification. For the people named in the BSI letter, the published route is the BSI, not a general helpline.