Infections on the mobile devices of six German MPs are considered confirmed, a Bundestag administration representative told the digital committee on 4 November 2026. The Bundestag's report published on 5 November says the affected lawmakers belong to different parliamentary groups. A separate flood of subscription emails is disrupting the Left Party parliamentary group. The incidents pose different problems: examining potentially compromised devices and keeping parliamentary email usable.
Key facts
- Parliament's administration reported six confirmed device infections affecting MPs from different groups.
- Forensic examination requires affected devices that have not yet been reset.
- In the separate email-bombing incident, administrators say filters intercept about ten million messages daily.
- The origin and perpetrators of the attacks remain unknown.
What is clearer than in the initial warnings?
According to the committee report, the Federal Office for Information Security, or BSI, informed parliament's administration about threat notifications on the preceding Thursday. The alerts had initially appeared among members of the Social Democratic parliamentary group. On Friday, the BSI provided recommendations that were passed on to MPs. The report of six confirmed infections is therefore more specific than the original warning of a possible compromise.
An alert and a confirmed infection are different findings. In documentation dated 13 August 2026, Apple describes its notifications as high-confidence warnings that someone has been individually targeted by a mercenary spyware attack. The company says they are based on internal threat intelligence and investigations.
Apple identifies politicians, journalists, activists and diplomats among the people targeted by these exceptionally sophisticated attacks. It does not attribute its notifications to particular attackers or geographical regions. Government representatives likewise told the committee that a state connection could neither be established nor ruled out. No commissioning party has been identified.
Preserving devices matters for the next stage. Parliament's representative said forensic investigators need affected phones that have not already been reset. She also announced a review of device updates and management, alongside communication and reporting channels. The committee report gives no completion date for that review.
Why is the email flood a separate problem?
The attack against the Left Party group has continued since Saturday morning. MPs' email addresses are being used to sign up for newsletters and other online services around the world. Many messages therefore come from legitimate providers whose services are being abused, complicating attempts to block the flood simply by identifying malicious senders.
Administrators say filters catch roughly ten million messages a day, yet about 100 to 200 spam messages an hour still reach MPs. Those figures describe intercepted and delivered messages, rather than compromised email accounts. A Left Party MP additionally reported peaks of up to 30,000 spam emails a minute and substantial disruption to parliamentary work.
Because messages arrive from many countries and in different languages, the administration is working with the group to improve filtering. The BSI is also expected to help investigate using messages supplied to it. Committee members pressed for lessons that would protect email availability and parliament's ability to function.
Apple recommends expert assistance for recipients of its spyware notifications and points to Lockdown Mode as additional protection. It says genuine warnings can be checked on the user's Apple Account page and never demand passwords, software installation or opened files. For parliament, the concrete next steps remain examination of available devices, review of reporting channels and better email filtering.
