Spain said Monday that the mobile phones of Spanish Prime Minister Pedro Sanchez and Defence Minister Margarita Robles were tapped using Pegasus spyware in an "illicit and external" intervention.
Their phones were infected last year by software owned by the Israeli-based firm NSO, which is the target of numerous investigations worldwide, according to a senior official.
"It is not a supposition, they are facts of enormous gravity," said the minister of the presidency, Felix Bolanos.
"We are absolutely certain that it was an external attack... because in Spain, in a democracy like ours, all such interventions are carried out by official bodies and with judicial authorisation," he said.
"In this case, neither of the two circumstances prevailed, which is why we have no doubt that it was an external intervention. We want the judiciary to investigate," Bolanos said.
He did not say whether the Spanish authorities had any indication yet where the attack originated from or whether another country was behind it.
Bolanos said that Sanchez's phone had been tapped in May 2021 and Robles' in June of the same year.
"A determined amount of data" was extracted from both phones, he added.
"There is no evidence that there was other tapping after those dates."
The El Pais newspaper said the hackers extracted 2.6 gigabytes of information from Sanchez's phone and nine megabytes from Robles's phone, but the government still does not know "the nature of the stolen information and the degree of sensitivity."
The attack targeted their work phones provided by the state, not their private phones.
Bolanos said experts were checking whether other members of the Spanish government were targets of spying involving Pegasus.
He said the government on Monday filed a complaint with a Spanish high court tasked with significant national and international cases, which have included terrorism in the past, in order to bring the full facts to light.
Pegasus spyware infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.
The Israel-based NSO Group, which owns Pegasus, claims the software is only sold to government agencies to target criminals and terrorists, with the green light of Israeli authorities.
The company has been criticised by global rights groups for violating users' privacy around the world and it faces lawsuits from major tech firms such as Apple and Microsoft.
Amnesty International, the London-based human rights group, said the software has been used to hack up to 50,000 mobile phones worldwide.
Catalan separatists have accused Spain's intelligence services of using spyware to snoop on their mobile phones, reviving tensions with Sanchez's minority leftist government, which relies on their support to pass legislation.
Canada's Citizen Lab group said last month that at least 65 people linked to the Catalan separatist movement had been targets of Pegasus spyware in the wake of a failed independence bid in 2017.
Elected officials, including current and former Catalan regional leaders, were among those targeted by the controversial spyware.
