Spyware targeted former minister Agnès Pannier-Runacher's iPhone three times

On August 13, a notification from Apple landed on Agnès Pannier-Runacher's personal iPhone: the device had allegedly been targeted by so-called "mercenary" spyware. It was not the first time. The Renaissance member of parliament for Pas-de-Calais had received two similar alerts, on March 5 and April 29, 2025, when she was Minister for Ecological Transition.

Politico revealed the affair on October 20. The next day, the former minister confirmed it: "I was targeted twice as a minister," she said, according to L'Express, and a third time as a member of parliament. According to Apple, quoted by Politico, these are three separate attacks, not reminders about a single event.

A complaint, an investigation, no spyware identified

On September 28, Agnès Pannier-Runacher filed a complaint with the DGSI (the French domestic intelligence agency, Direction générale de la sécurité intérieure), which interviewed her twice. Her phone was examined by ANSSI (France's national cybersecurity agency, Agence nationale de la sécurité des systèmes d'information). The Paris prosecutor's office confirmed it has opened an investigation, assigned to its specialized cybercrime unit, covering all three episodes.

The spyware used has not been identified. According to Politico, however, investigators are ruling out Pegasus, the spyware made by Israel's NSO Group. Did the attack succeed? Nothing establishes that. The lawmaker says she was "targeted, but on first analysis not compromised," and noticed no abnormal behavior on her phone. She told Le Monde that the DGSI had not confirmed an infection at the time of the first alerts.

Who could be behind it?

According to Politico, domestic intelligence services favor the theory of foreign interference. The site ZATAZ, citing Politico, adds that the C4, a coordination body in which the DGSE (France's foreign intelligence service) takes part, was mobilized, which does not amount to a public attribution to a state.

The former minister offers her own hypothesis: a link to her work on phasing out fossil fuels. She mentions "a country close to fossil fuel interests," without naming it. No official source confirms this lead at this stage.

ANSSI has not commented on this case. According to ZATAZ, however, it says it has handled several compromises over the past three years of phones belonging to people working for top government authorities. This kind of spyware, sold to states, can sometimes install itself with no action from the victim, as the case of Candiru against Al Jazeera showed. Nothing indicates, however, that this was the method used here.

What to do if Apple sends you such an alert

In this case, the phone seemed to work normally. That is precisely why these alerts must not be ignored. A few reflexes:

• take the alert seriously, even if the device shows no sign of anything abnormal;
• do not reset the phone before it is analyzed, as it may hold traces useful to investigators;
• update iOS and turn on Lockdown Mode, designed by Apple for people exposed to this type of attack;
• if you are an elected official, executive or public servant, immediately notify your organization's security team or ANSSI, and consider filing a complaint, as the lawmaker did.

The underlying question remains: who has been interested for more than a year in this former minister's personal phone? The Paris prosecutor's investigation will have to say whether the attacks really targeted her office, and whether they failed, as early analyses suggest.