Apple says threat notifications reach 99 countries, over 150 in total, naming no attacker or people count
Apple says it is sending mercenary spyware threat notifications to targeted users in 99 countries, bringing its stated total to over 150 countries, a figure its support page has carried since at least April 2025. It names no attacker, vendor or number of people, and says targeted, not infected.
By Parminder Kumar Sharma · LinkedIn · · 17 min read
Apple's total is still "over 150" countries, and 99 is one batch
Apple's support page says it has "notified users in over 150 countries in total". That sentence reads the same in every capture of the page checked, from a web archive copy of 24 April 2025 to the page as fetched on 30 October 2026, which is 554 days (derived). So the figure in today's news, notifications "being sent to targeted users in 99 countries", is a count for one batch. It does not move the total, and it is not a count of people. Nobody outside Apple can say from the record how many people got a notice, which countries they are in, who attacked them, or whether any device was in fact compromised.
CyberScoop reported the new round at 17:07 GMT on Friday 30 October 2026. This briefing was built from 18:50 GMT that evening. The statement about 99 countries comes to us only through CyberScoop, which says "the company said" and links that phrase to a post on X. This site did not read that post: X's robots file disallows automated fetching for our user agent, so it was left alone. Apple's own support page, read in full, does not contain the number 99. Apple is the sender of every notice and the only source for what they mean, so every figure here is Apple's own claim about its own detection, and no outside party has checked it.
The primary sources read were Apple's page on threat notifications (dated 13 August 2026), Apple's Lockdown Mode page (dated 14 September 2026), Access Now's page on the helpline and Apple notices, and CyberScoop's report with the three CyberScoop articles it links. BleepingComputer's August report was read for the previous batch. The sections below set out what Apple states, what it leaves out, what a person should do, and what the absence of a notice does not mean.
Stated and not stated: Apple's record, line by line
Apple's page describes what a notice is for: "Apple threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware attacks". The table separates what Apple prints from what it does not. "Not stated" means not found on the pages read, and does not mean the information does not exist. Apple gives a reason for the silence: "We are unable to provide information about what causes us to issue threat notifications", because that could help attackers evade detection.
What Apple's support page (published 13 August 2026, read 30 October 2026) and CyberScoop's quotation of Apple state, and what neither states.
| The question | Stated | Not stated |
|---|---|---|
| How many countries? | 99 in this batch, per CyberScoop quoting Apple. Over 150 in total since 2021, per Apple's page. | Which countries, how many people, and how many countries are in both this batch and the August one. |
| What is the attack? | A mercenary spyware attack, aimed at individuals "likely because of who they are or what they do", costing "millions of dollars". | Which product, which exploit or flaw, and any identifier of a device that was reached. |
| Who is behind it? | Apple "does not attribute" attacks to "any specific attackers or geographical regions". The page gives NSO Group's Pegasus as an example of the class. | Any vendor, client, state or group for this batch. |
| Was the device infected? | A user "has been individually targeted". The alert text in Apple's screenshot says an attack was "targeted at your iPhone". | Whether any attempt succeeded. Apple's page does not use the word infected. |
| How sure is Apple? | It calls the notices high confidence alerts, and adds that its investigations "can never achieve absolute certainty". | A false positive rate, or how detection works. |
| Which devices? | "Notification types may vary based on the user's device model and software version." | Which models or iOS versions were targeted or are exposed. |
| Who else knows more? | Outside organisations "don't have any information about what caused Apple to send a threat notification". | Anything that lets a recipient or a helper learn the cause from the notice. |
The wording of the 99 country statement differs slightly from the page. CyberScoop quotes Apple as saying it does not attribute "the attacks or the notice you're receiving" to specific attackers or regions. The page says "the attacks or resulting threat notifications". The first reads like the text of the notice sent to recipients, but that is an inference, since this site has not seen the notice text of this batch. This site has read another Apple statement for exactly what it leaves out: one 29 word sentence on three CoreGraphics advisories.
The diagram puts Apple's side of the exchange in one view, with the gaps marked.
Three counts of countries, and why they cannot be added up
Three figures are in play. First, Apple's total, "over 150 countries" since 2021 (the page says it has sent notices "multiple times a year" since then). Second, the August batch: Apple confirmed to BleepingComputer that it sent a new batch on 13 August 2026 to targeted users in 110 countries. Third, today's batch in 99 countries. CyberScoop says Apple's "last major batch of notifications" was in August, which matches. The gap between the two batches is 78 days (derived).
What can be done with those numbers? Very little, and the exact limits are worth stating. The two batches could cover at most 209 countries between them (derived: 110 plus 99), but Apple does not say how many countries appear in both, so the union is unknown. The share 99 of 150 is 66 per cent (derived), but 150 is a floor, "over 150", so the share is not a real fraction. Countries are also not people: a batch could be a very small number of individuals in each country, and Apple prints no head count for any batch. The check made here is limited to the captures read, which were 24 April 2025, 30 May 2026, 23 July 2026, 20 October 2026 and the live page on 30 October 2026, and each carries the "over 150" wording. Other captures were not read.
Targeted is not infected: three labels that do the work of a finding
CyberScoop's headline says the notifications "alert victims in 99 countries about mercenary spyware infections". Apple's page says users "may have been individually targeted", and the alert in Apple's screenshot says an attack was "targeted at your iPhone". Apple's page never uses the word infected, victim or compromised. That is a gap between a headline and the primary, and a reader should follow the primary. The point is not that Apple is understating: the page calls the notices serious and high confidence. It is that a recipient cannot tell from the notice whether anything got in.
Labels in this story, where each appears and what the record shows.
| The label | Where it appears | What the record shows |
|---|---|---|
| "Infections" and "victims" | CyberScoop's headline. | Apple's page and alert say targeted. An outside forensic check is what could show an infection, and Apple says outside organisations do not know what caused the notice. |
| "High confidence" | Apple's page. | Apple's own judgement, from detection it will not describe, with a stated limit: it "can never achieve absolute certainty". It cannot be tested from outside. |
| "Mercenary spyware" | Apple's page, the alert and CyberScoop. | A class of product, not a named one. Apple names Pegasus as an example of the class and attributes nothing in this batch to it. The page says such attacks have "historically been associated with state actors". |
| "Over 150 countries" | Apple's page and the statement. | A cumulative floor since 2021 that has not moved in the captures read. It is not a measure of how big this batch is. |
On interest: Apple sells the devices it says it is protecting, runs the detection, writes the notice and is the sole source of the 99 and 150 figures. Publishing a count of countries is a way to show the programme is active without showing how many people it concerns, and that is an observation about what the figure can do, not an accusation. A senior researcher at The Citizen Lab (University of Toronto) told CyberScoop the notifications were significant, "based purely on what we see publicly". Access Now's senior tech legal counsel said the number of notifications seen "indicates that the fight against the scourge of spyware abuse is far from over". Both organisations work with people who receive notices, so they have their own reasons to say the problem is large. Their statements are quoted as opinion.
What a notice leads to, and what no notice does not mean
A notice is the start of an investigation, not the end of one. Access Now says the language in Apple's notices "does not indicate what attacker or technology the company detected", and that the notices are "often related to attempts to access your device some months previous to the notification". In a Serbian case CyberScoop reported on 19 October 2026, a digital rights group said a person who had received an Apple notice had a device whose spyware type neither it nor The Citizen Lab could identify, and the examination was continuing. A different device in the same case was confirmed by The Citizen Lab as infected with Pegasus, and the article does not say whether that person received a notice. One notified device stayed unidentified; one confirmed infection has no stated notice. The notice and the forensic answer are separate things.
The reverse matters just as much for people who got nothing. The Citizen Lab researcher, as CyberScoop reports it, "cautioned that the lack of notification doesn't rule out an infection". Apple's page is consistent with that: it says Apple relies solely on its own threat intelligence, that its investigations cannot reach certainty, and that it cannot explain what triggers a notice. A missing notice therefore means only that Apple did not send one. Apple's own advice for people with no notice is limited: if you have good reason to believe you may be individually targeted, you can enable Lockdown Mode, and the Consumer Reports Security Planner site lists emergency resources.
Help is also narrower than the headline suggests. Apple points recipients to the Digital Security Helpline at Access Now. Access Now's own page says the helpline "can only assist members of civil society", meaning independent journalists, bloggers, activists and human rights defenders, and that Access Now "plays no role in identifying or sending out Apple's threat notifications". A recipient who is a public official, a business person or a diplomat is not in that group, and Apple's page names politicians and diplomats among those historically targeted. Access Now says to follow Apple's guidance or contact other specialists.
The Pall Mall Process: what CyberScoop says, and what no source here shows
CyberScoop says the notifications "come shortly before the final rounds of negotiations over industry standards for commercial hacking tools being developed under the voluntary Pall Mall Process", and that the industry guidelines follow "an earlier set of guidelines catered to governments". Its earlier reports give the background. On 7 April 2025 it reported that 21 nations had signed a voluntary Code of Practice for States in Paris, with four pillars: accountability, precision, transparency and oversight. On 26 January 2026 it reported a closed discussion, under the Chatham House rule, on who industry guidelines should apply to and how compliance could be measured, and that the rules would not be binding.
What is not in the record: a date for the final negotiations, the text of any draft guidelines, and any statement from Apple that it timed this batch to the talks. The words "shortly before" are CyberScoop's framing. Apple's page does not mention the process. The Pall Mall documents themselves were not read for this briefing, because CyberScoop does not link them. Access Now's senior tech legal counsel is quoted saying the states that will adopt the guidelines "must come to terms that the current system is not working". That is an advocacy position from an organisation that supports people targeted by spyware.
What to do, in the order worth doing
Everything below comes from Apple's pages, Access Now's helpline page or the researcher's statement quoted by CyberScoop, and each item names its source in the wording. Nothing here depends on knowing who attacked.
Take this with you
If you received an Apple threat notification
- Do not delete the notice, and do not act on a link in any message. Sign in at account.apple.com yourself: Apple says a genuine notice is clearly visible at the top of that page.
- Keep the device. Access Now says not to erase it, because erasing will not necessarily prevent new infections, and to make a backup to preserve potential evidence.
- Update your devices to the latest software, as both Apple and Access Now advise, then turn on Lockdown Mode, which Apple recommends in the notice.
- Contact the Digital Security Helpline at Access Now if you are in civil society, or other specialist help if you are not. Do this before changing accounts or devices, so the evidence is kept.
- Be cautious about companies offering paid fixes for spyware infections, as the Citizen Lab researcher warned. Apple's notices never ask for a payment, a code or a click.
- Expect delay: Access Now says vetting and analysis can take some time, and the notice can concern an attempt from some months earlier.
Take this with you
If you are at risk but received nothing
- Treat no notice as unproven, not as clear. The Citizen Lab researcher said the lack of a notice does not rule out an infection.
- Update your devices and turn on Lockdown Mode if you have good reason to believe you may be individually targeted, which is Apple's own advice.
- Read what Lockdown Mode switches off before you enable it: most message attachment types, link previews, some web technologies and configuration profiles. Apple says it is meant for very few people.
- If you need emergency help for other reasons, use the Consumer Reports Security Planner emergency resources that Apple points to.
Take this with you
For newsrooms and civil society IT
- Tell staff in advance what a real notice looks like, and that Apple says it never asks anyone to click, open, install or give a code. Name one person who verifies on request.
- Agree who holds the helpline contact, who preserves a notified phone, and who speaks to the person, before the first notice arrives.
- Ask at risk staff to enable Lockdown Mode before an incident. Note that Apple says it is not a configurable option for managed device systems, and that a device already enrolled in management stays managed.
- Do not publish a staff member's notice or a screenshot of it without their consent, and do not guess a country or a vendor from one notice, because Apple names neither.
- Keep a log of notices received, with dates, for the helpline and for any investigator. Apple's page and Access Now both say the notice alone does not identify the attacker.
Technical details
Apple prints no indicators for this batch: no hashes, domains, file or process names, no vulnerability identifier, no exploit, no list of device models or iOS builds. It says it cannot explain what triggers a notice. The artifacts below are the ones Apple's pages do print: the wording a recipient sees, where to verify it, the sender address, and the Lockdown Mode setting path. They are for verification and hardening, not detection. Each is copied from the page named, read on 30 October 2026.
Apple Threat Notification
Apple detected a mercenary spyware attack targeted at your iPhone. There are actions you can take now to help protect your data and device.
Apple says it notifies in three ways and that the notice should be verified at the account page, not through a message. The page prints the sender address of the email.
To verify that an Apple threat notification is genuine, sign in to account.apple.com. If Apple sent a threat notification, it’s clearly visible at the top of the page after sign-in.
As of 2026, we notify targeted users directly on iPhone and via email sent from Apple Threat Notifications (threat-notifications@email.apple.com).
Apple threat notifications never ask the user to click any links, open files, install apps or profiles, or provide an Apple Account password or verification code by email or on the phone.
Threat Notification
Apple sent you a threat notification via email and iPhone alert on February 6, 2026. View Details
Lockdown Mode is the one control Apple names. Its page says it is available in iOS 16 or later, iPadOS 16 or later, watchOS 10 or later and macOS Ventura or later, with additional protections from iOS 17, and that devices should be updated before it is turned on.
How to turn on Lockdown Mode on iPhone or iPad
Open the Settings app.
Tap Privacy & Security.
Scroll down, tap Lockdown Mode, then tap Turn On Lockdown Mode.
Tap Turn On Lockdown Mode.
Tap Turn On & Restart, then enter your device passcode.
Access Now's page adds one step Apple's page does not print, which is to preserve the device rather than wipe it.
1. Ensure your device’s operating system is up-to-date. You can find instructions here.
2. Follow the guidelines provided by Apple, including instructions to set up Lockdown mode, which you can review here.
3. Do not erase your device, as it will not necessarily prevent new infections. Instead, make a backup of the affected device to preserve potential evidence of the phone being targeted. You can find instructions here.
What could not be verified
- The 99 country statement. It rests on CyberScoop's quotation. The post CyberScoop links as "the company said" is on X, whose robots file disallows our fetch, so it was not read. Apple's support page does not contain the figure. Apple, per CyberScoop, had not immediately responded to a request for comment about the countries.
- Number of people notified, countries, victims and any attribution. Not printed in any source read. Researchers quoted say the batch is significant, which is opinion.
- The August batch of 110 countries. From BleepingComputer, which says Apple confirmed it. The Hacker News's August report was not readable (a bot check), so it was skipped.
- Pall Mall. The dates and drafts of the negotiations are not in the record, and the Pall Mall documents were not read.
- Earlier rounds. Dates and counts of earlier batches are not printed by Apple; only the August batch is reported here.
- Time stamped. Sources were read between 18:50 and 19:05 GMT on 30 October 2026. Apple's page, or a new statement, could change within hours.
The question that exposes the gap
If Apple says it has notified users in over 150 countries but cannot say how many people, who attacked them or whether any device was breached, what exactly can a recipient, a newsroom or a regulator do with the number, and who is checking the detection that produces it?
Key facts
Sources
- PrimaryApple Support, 'About Apple threat notifications and protecting against mercenary spyware', published 13 August 2026: what a notice is, delivery, confidence, the over 150 countries total, no attribution, steps. Read in full and fetched again at the endAppleaccessed 2026-10-30
- PrimaryApple Support, 'About Lockdown Mode', published 14 September 2026: what it is, versions, the setting path, the managed device noteAppleaccessed 2026-10-30
- PrimaryAccess Now page on its Digital Security Helpline and Apple threat notifications: no role in sending notices, civil society only, do not erase the device, notices often concern earlier attemptsAccess Nowaccessed 2026-10-30
- PrimaryArchive capture of Apple's page dated 24 April 2025, page dated 23 April 2025: the same over 150 countries sentence. Other captures of 30 May, 23 July and 20 October 2026 were also readInternet Archive (Wayback Machine)accessed 2026-10-30
- Reported byCyberScoop, 30 October 2026, 17:07 GMT: the quoted Apple statement, researcher and Access Now comments, last batch in August, the Pall Mall Process timing. Secondary; the Apple statement is quoted second handCyberScoopaccessed 2026-10-30
- Reported byCyberScoop, 19 October 2026, linked by the 30 October report: a case in which a notice recipient's device could not be tied to a spyware typeCyberScoopaccessed 2026-10-30
- Reported byCyberScoop, 7 April 2025, linked by the 30 October report: 21 nations signed the voluntary Code of Practice for StatesCyberScoopaccessed 2026-10-30
- Reported byCyberScoop, 26 January 2026, linked by the 30 October report: industry guidelines for the Pall Mall Process under discussion, not bindingCyberScoopaccessed 2026-10-30
- Reported byBleepingComputer, 13 August 2026: Apple confirmed a batch sent on 13 August to targeted users in 110 countries. Secondary, used only for the previous batchBleepingComputeraccessed 2026-10-30
