Apple sent threat notifications to users in 99 countries from 30 October 2026 – in Germany they reached MPs and government staff, and the NCSC urges every recipient to act fast.
Key points
- Apple sent a new wave of threat notifications from 30 October 2026, warning targeted users in 99 countries that they may have been hit by mercenary spyware.
- In Germany, the alerts reached members of the Bundestag and of the federal government; the German BSI told those affected to treat their iPhone as compromised and to enable Lockdown Mode.
- Apple has not published which other countries were affected – the UK’s National Cyber Security Centre (NCSC) has not commented on this specific wave, but it does publish standing guidance on protecting high-risk individuals from targeted surveillance.
- Apple names neither the vulnerability nor a suspected attacker; researchers say such attacks typically target journalists, activists, diplomats and politicians.
Apple has sent a fresh wave of “threat notifications” to iPhone users it believes have been targeted by mercenary spyware – 99 countries were affected, Apple’s own notification text shows. In Germany, the warning reached MPs and government staff; it is not known whether anyone in the UK was among the recipients, because Apple does not publish a country list.
The alerts began arriving on affected devices from Friday, 30 October 2026. It is the second such wave within eleven weeks, after Apple warned users in around 110 countries in mid-August. Apple’s support page for the programme still carries the August wording, and the company has made no separate public statement about the October wave; the 99-country figure comes from the notification text itself, reported by the security researcher who first published it.
Apple never attributes these attacks to a specific government or vendor, and does not confirm that a device was actually compromised – only that it was identified as a likely target.
What happened in Germany
Germany is the one country confirmed to be among the 99: the Federal Office for Information Security (BSI) told affected members of the Bundestag and of the federal government to treat their iPhone as compromised, disconnect it from Wi-Fi and mobile networks, enable Lockdown Mode and have the device examined forensically – even though the BSI said it knew of no confirmed successful breach at the time. German digital minister Karsten Wildberger confirmed the incident on public broadcaster ARD, saying the BSI had “acted very quickly” and contacted those affected immediately; he gave no numbers or names.
No UK government department or agency has confirmed being among the targets of this particular wave, and Apple’s notification text that is public does not name the UK. That does not rule out UK recipients – Apple’s programme routinely reaches high-risk individuals worldwide – it simply means there is, at the time of writing, no confirmed UK case to report.
How Apple’s threat notifications work
Apple has operated this alert system since 2021 and says it has, by its own account, notified users in more than 150 countries in total. An earlier wave in August 2026 reached around 110 countries.
„Apple threat notifications are high-confidence alerts.“
Apple, support document “About Apple threat notifications and protecting against mercenary spyware”
In plain terms: Apple only sends these alerts when its own threat intelligence gives it high confidence that a device has been targeted in a sophisticated, individually targeted attack – as opposed to ordinary cybercrime or malware. Apple says genuine notifications only ever arrive through three channels: a notice directly on the iPhone, an email from threat-notifications@email.apple.com, and a banner shown after signing in at account.apple.com.
Those are the only ways to verify a notification is genuine. Apple never asks recipients to click a link, download a file, enter a password or provide a verification code as part of a threat notification.
What this means if you are in the UK
Because Apple does not publish which of the 99 countries were affected, there is no way to confirm or rule out UK recipients from the outside. Anyone in the UK who receives a genuine Apple threat notification should treat it exactly as the BSI advised affected Germans to: assume the device may be compromised, enable Lockdown Mode, and seek independent technical help rather than trying to clean the phone alone.
The UK’s National Cyber Security Centre, part of GCHQ, publishes general guidance for people who may be at higher risk of targeted digital surveillance – including journalists, activists and public figures – though it has not issued a statement specifically about this October wave. Its guidance is a reasonable starting point for anyone in the UK who receives an Apple notification and wants a second, independent source of advice alongside Apple’s own.
Who is behind mercenary spyware
It remained unclear at the time of publication who carried out the attacks behind this wave. Apple deliberately does not name the vendor or the exploited vulnerability, so as not to hand attackers additional information. In reporting on earlier waves, the Pegasus spyware built by Israel’s NSO Group has repeatedly served as a reference point for what such tools can do; there is, on current evidence, no confirmed link between Pegasus and this specific wave.
Security researchers say spyware of this kind can read encrypted messages, call logs, contacts, calendar entries and location data, and can remotely activate a device’s camera and microphone. Some such attacks use so-called zero-click vulnerabilities, for example via iMessage, where the victim does not need to click anything at all.
Researchers estimate the cost of a single successful attack of this sophistication often runs into several million euros – one reason journalists, activists, diplomats and politicians remain the classic targets rather than the general public.
Since 2024, the UK and France have jointly driven the so-called Pall Mall Process, an international initiative against the misuse of commercial surveillance tools. More than two dozen states have signed up to a code of practice for governments; a complementary code for vendors of such software is expected to follow, according to the UK government.
How to protect yourself
Anyone who genuinely receives an Apple threat notification should, per Apple’s and the BSI’s advice, enable Lockdown Mode – an optional protection built into iPhone, iPad and Mac that sharply restricts common attack routes such as message attachments, link previews and incoming invitations or calls from unknown contacts. Independent technical support is also worth seeking, for example via the round-the-clock Digital Security Helpline run by the non-profit Access Now.
Checklist: what to do if you get an Apple threat notification
- Verify it only through Apple’s own channels: directly on your iPhone, by email from “threat-notifications@email.apple.com”, or in the banner shown after signing in at account.apple.com.
- Never click a link or open an attachment that claims to be from Apple – a genuine notification never asks for a password, a code or a file download.
- If the notification is genuine, enable Lockdown Mode in iPhone settings and disconnect the device from networks as a precaution.
- Seek independent advice, for example from Access Now’s Digital Security Helpline.
- Regardless of any notification, everyone should: keep their operating system fully up to date, set up two-factor authentication and a strong Apple password, enable Stolen Device Protection, and only install apps from the App Store.
These basic steps protect against far more common threats too, such as fake Apple emails or SMS phishing – which is why security agencies recommend them regardless of the specific incident.
Frequently asked questions
What is “mercenary spyware”?
It refers to highly specialised, commercially sold surveillance software used against specific individuals, capable of deeply penetrating a smartphone – including reading encrypted messages and remotely controlling the camera and microphone. Researchers say a single successful attack often costs several million euros, which is why journalists, activists and diplomats are the classic targets.
How do I recognise a genuine Apple notification?
Apple only informs people through three of its own channels: a notice directly on the iPhone, an email from threat-notifications@email.apple.com sent to the address linked to the Apple Account, and a banner shown after signing in at account.apple.com. Apple never asks for a password, a code or a file download.
What exactly does Lockdown Mode do?
Lockdown Mode is an optional Apple feature for iPhone, iPad and Mac that significantly reduces a device’s attack surface – among other things, it restricts message attachments, link previews and incoming invitations or calls from unknown contacts. The BSI recommends enabling it for anyone who has received an Apple threat notification.
Was anyone in the UK affected by this wave?
That is not publicly known. Apple has not published which of the 99 countries were affected, and no UK department or agency has confirmed being among the targets of this specific wave. Germany is, so far, the only country confirmed, through the BSI and digital minister Karsten Wildberger.
Sources and status
- Apple: “About Apple threat notifications and protecting against mercenary spyware”, support.apple.com, as of 13 August 2026.
- Germany’s Federal Office for Information Security (BSI): notice to affected MPs and government staff, 1 November 2026, reported via bsi.bund.de (in German).
- ARD, “Bericht aus Berlin”: interview with German digital minister Karsten Wildberger, 2 November 2026 (in German).
- TechAeris: “Apple sends new threat notifications”, report on the October 2026 wave citing the notification text, techaeris.com, 30 October 2026.
- UK Government: “The Pall Mall Process Code of Practice for States”, gov.uk.
Research and data as of: 3 November 2026.
Transparency note: AI-assisted tools were used in researching, structuring and writing this article. The sources used are listed in the article. Publication takes place only after manual editorial approval. Country edition based on an article by Net Trends, researched for the United Kingdom.
Share this article
