The phones of Spanish Prime Minister Pedro Sanchez and Defense Minister Margarita Robles have both been infected with Pegasus spyware, in a significant security breach.

The government minister for the presidency Felix Bolanos said that Mr Sanchez's phone was infected in May, 2021, and Ms Robles' was targeted the following month.

"A determined amount of data" was extracted from both phones, he said, adding: "There is no evidence that there was other tapping after those dates." 

Speaking in a press conference on Monday he didn't give any indication of who may have been behind the hacking and whether it may have been a foreign state or a politically motivated group.

READ MORE

Ukraine crisis threatens global food security

Bridge Builders: The Anglo-Chinese Guo family

1980s China: in photographs

The case now with the justice ministry.

"It is not a supposition, they are facts of enormous gravity," the minister of the presidency, Felix Bolanos, said, confirming the news. 

"We are absolutely certain that it was an external attack... because in Spain, in a democracy like ours, all such interventions are carried out by official bodies and with judicial authorisation," he said.

"In this case, neither of the two circumstances prevailed, which is why we have no doubt that it was an external intervention. We want the justice to investigate," Bolanos said.

Pegasus spyware, made by Israel's NSO group, silently infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.

The revelation about the ministers' phones comes after the Spanish government was accused of targeting Catalan separatists with Pegasus spyware last month.

Canada's digital rights group Citizen Lab said more than 60 people linked to the Catalan independence movement had been targeted with Pegasus.

"It's an unjustifiable disgrace," Catalan leader Pere Aragones tweeted. "An extremely serious attack on fundamental rights and democracy."

Describing the use of surveillance software as crossing a "red line", he demanded explanations from the Spanish government.

NSO, which markets the software as a law-enforcement tool, said Citizen Lab and Amnesty International, which was not involved in this investigation but has published previous studies about Pegasus, had produced inaccurate and unsubstantiated reports to target the company.

"Information raised regarding these allegations are, yet again, false and could not be related to NSO products for technological and contractual reasons," a spokesperson said via email without explaining why this was the case.

Toronto-based Citizen Lab said almost all of the infections took place between 2017 and 2020 in the wake of the independence bid by Catalonia that plunged Spain into its worst political crisis in years.

After the allegations of spying on members of the Catalan separatist movement, the minority government's key ally in parliament, Catalonia's leftist pro-independence party ERC, said it would not support the government until Madrid takes measures to restore confidence.

The European Union's data protection watchdog has called for a ban on Pegasus over allegations it has been abused by client governments to spy on rights activists, journalists and politicians.

A European Parliament committee has begun investigating Pegasus spyware cases, looking into accusations of spying leveled against EU member states. 

The new committee will investigate whether or not Pegasus software has breached EU law and fundamental rights.