Costin Raiu reported on October 30, 2026, that a new round of Apple Threat Notifications was going out. The Apple notice he reproduced said the batch covered targeted users in 99 countries. It described a separate August wave and gave a cumulative total of more than 150 countries, a different figure with a broader time span.

What Apple’s October notice said

The reproduced notice did not name specific attackers or regions. Raiu described the round as distinct from the August wave and tied to new attacks. His post preserves the notice’s distinction between the 99 countries in this batch and the more than 150 countries Apple said it had notified in total.

What an Apple threat notification means

An iPhone-style Lock Screen displays an Apple Threat Notification about mercenary spyware.

Apple says its threat notifications are designed to inform and assist people who may have been individually targeted by mercenary spyware. Receiving one signals possible targeting; by itself, the alert does not establish that spyware successfully compromised the device. Apple Support explains the notifications and protection guidance.

Where alerts may appear and what recipients can do

Gizmodo reported that Apple alerts may appear on the Lock Screen, in Settings, by email or on the Apple Account page. The available display channels can vary with the device model and software version.

BGR reported that Apple recommends keeping devices updated, turning on Lockdown Mode and seeking expert help through Access Now’s Digital Security Helpline. On iPhone, BGR reported that Lockdown Mode is available with iOS 16 or later at Settings > Privacy & Security > Lockdown Mode. It can restrict messaging attachments and some web technologies, so it changes how some features work.

What was reported about German officials

BGR reported that Digital Minister Karsten Wildberger confirmed members of Germany’s federal government and parliament received warnings. The same report said the Federal Office for Information Security (BSI) advised recipients to assume an attack had succeeded. That was precautionary advice, not a forensic finding of infection.