Smartphones belonging to members of Germany’s Bundestag and federal government officials have been targeted in an advanced cyber espionage campaign utilizing mercenary spyware. Digital Transformation Minister Karsten Wildberger confirmed the security breach on Monday, stating that affected users began receiving automated threat notifications directly from Apple warning of potential state-sponsored intrusions.
Speaking to German broadcasters ARD and ZDF, Wildberger noted that the incident remains under active investigation. Germany’s Federal Office for Information Security (BSI) has categorized the threat as mercenary spyware, pointing to Israeli-developed Pegasus as a prominent example of the software class typically deployed by state actors. The agency has not publicly identified who is responsible for the targeting.
BSI Issues Compromise Warnings and Guidance
Following the automated alerts from Apple, the BSI issued formal written warnings to impacted lawmakers and civil servants. The agency advised targeted individuals to operate under the assumption that their devices are fully compromised, even though Apple’s notifications do not definitively confirm whether the intrusion attempts succeeded.
The BSI recommends that affected officials replace their devices, obtain new phone numbers, and transfer only essential data. Security guidelines highlight that advanced mercenary spyware can bypass encryption without requiring any action from the device owner, such as clicking a link. Once installed, the malware can access private messaging apps, call logs, contact lists, calendar schedules, steal passwords, track real-time locations, and remotely activate microphones and cameras.
Broader European Context and Prior Intelligence Arrests
The scale of the operation remains unverified, though the BSI stated that other public figures have also been targeted without disclosing specific names or numbers. Spyware tools developed by Israel’s NSO Group and similar firms have previously surfaced across nearly a dozen EU countries since 2016, including Cyprus, Denmark, Italy, Greece, Hungary, Poland, and Spain, where they have been used to monitor journalists, political opponents, and senior officials.
In 2023, the European Parliament urged the implementation of stricter control measures to curb spyware abuse, though the European Commission did not enact the proposals. The current cyber incident also unfolds alongside a separate security case in Germany involving the arrest last month of former BND chief August Hanning on espionage and treason charges. Hanning, who led the foreign intelligence service from 1998 to 2005, is accused of procuring classified documents for private consultancy work, including an unidentified foreign intelligence service.
