Apple’s 99-country spyware wave reaches Berlin — and the figure comes from a Beirut filmmaker’s screenshot

Apple threat notifications began arriving on 29 October, according to Germany’s Federal Office for Information Security, the BSI, which wrote to Bundestag members the following day recommending protective measures and asking recipients to make contact. On 1 November the federal Digital Minister, Karsten Wildberger, confirmed on ARD’s Bericht aus Berlin that there had been “a notification from Apple that certain devices may have been compromised with so-called spyware”. The BSI told TechCrunch on 2 November that anyone receiving such a notification “should therefore assume that their device may have been compromised,” and said in its November advisory the following day that it cannot determine whether the alerts reflect successful infections or attempted attacks, and has not identified the recipients, the spyware, or those responsible. Apple has not disclosed how many individuals were notified; Euronews states the number is not known.

The 99-country figure, carried by TechCrunch, the Financial Times and 9to5Mac, does not come from an Apple press statement — there appears to be none. It rests on the notice received by Radwan Mortada, a Beirut-based filmmaker, who posted a screenshot of his alert on X; the text reproduced by IBTimes UK is truncated in every published version, reading that the notification is being sent to targeted users in 99 countries and that Apple has to date notified users in over 150 countries. Korben reported on 3 November that Mortada had been targeted with Pegasus in 2017 and again in 2021 and received this alert after the release of his documentary on the Hezbollah pager operation — a causal framing that is the outlet’s, not Mortada’s. TechCrunch notes that the best-known mercenary vendor is Israel’s NSO Group and that Germany’s BKA reportedly bought Pegasus access in 2019. Nobody has connected NSO to this wave.

Assessment: The story is being read in Berlin as a German political scandal. The sourcing says otherwise: the only quantified element of the wave entered public record through a Lebanese journalist’s phone, which is a fair description of how mercenary-spyware reporting has worked for a decade. Hold two lines. A notification is a notification, not a confirmed infection, and the BSI says so in writing. And an unattributed wave is unattributed — the vendor name, if one emerges, will come from Citizen Lab or Amnesty’s Security Lab forensics on a recipient device, not from Apple. Watch whether anyone else in Lebanon, Jordan, Morocco or the Gulf comes forward.