On 5 November 2026, the relevant Bundestag committee examined two separate cyber incidents: an Apple warning about the possible compromise of individual mobile devices by commercial spyware, and a massive flood of emails that targeted the parliamentary group’s inboxes The Left on 2 November 2026, disabling them, according to the group. Digital Minister Karsten Wildberger confirmed in early November 2026 that Apple had sent a notification about possible infections with so-called mercenary spyware ; the Federal Office for Information Security (BSI) was subsequently named as the point of contact for those affected. (The ministry and BSI have confirmed this in media reports and official notices.)
According to the Left Party, the spam attack specifically targeted internal email accounts in the Bundestag and generated tens of thousands of incoming messages in a short time, according to the parliamentary group; the disruption mainly affected the usability of inboxes and internal communications. Bundestag administration and IT officials are said to have acted promptly to throttle and filter the traffic. At present, security authorities and government bodies are investigating the two incidents separately; initial media reports and statements from the organisations concerned have repeatedly noted that there is so far no confirmed evidence of a direct connection between them.
From a security architecture perspective, the two incidents point to distinct but complementary threat patterns: highly targeted, technically sophisticated compromises of individual mobile devices on the one hand, and large-scale overload or disruption attacks on communications infrastructure on the other. Security authorities and parliamentary IT officials stressed the need for immediate protective measures (such as checking devices, replacing compromised devices and tightening email filters), as well as medium-term organisational changes, for example to access controls and staff awareness.
Politically, the incidents have prompted calls for better resourcing of parliamentary IT, clearer reporting channels and closer cooperation with security authorities. The authorities have not yet identified any individuals responsible or perpetrators; criminal and technical investigations are under way. Statements from the ministry, BSI and the parliamentary groups concerned, together with dates in press reports, form the basis of this account; speculation about those behind the attacks or their motives cannot currently be substantiated and has not been included.
Editor: Phillipe Schmidt-Araguin (Article created with AI assistance).