The breaches were not authorised by a Spanish judge and resulted in a significant amount of data being obtained from the mobile phones of Prime Minister Pedro Sanchez and Defence Minister Margarita Robles.
Spain has said that the mobile phones of Prime Minister Pedro Sanchez and Defence Minister Margarita Robles were tapped using Pegasus spyware in an "illicit and external" intervention.
Sanchez's phone was breached twice in May 2021 and Robles’ device was targeted once the following month, Cabinet Minister Felix Bolanos told a news conference on Monday.
"We are absolutely certain that it was an external attack... because in Spain, in a democracy like ours, all such interventions are carried out by official bodies and with judicial authorisation," Bolanos said.
"In this case, neither of the two circumstances prevailed, which is why we have not doubt that it was an external intervention. We want the justice to investigate," he added.
Bolanos refused to speculate who might have been behind the Pegasus breach, nor what might have prompted it.
The National Court opened an investigation into the breach, and a parliamentary committee on intelligence affairs was set to look into it.
The government was during those months under intense scrutiny over its handling of a major foreign policy spat with Morocco and gripped by a tense domestic dispute over the release of jailed separatists from Spain's restive Catalonia region.
Tensions with Catalan separatists
Pegasus spyware silently infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.
The Israel-based NSO Group, which owns Pegasus, claims the software is only sold to government agencies to target criminals and terrorists, with the green light of Israeli authorities.
The company has been criticised by global rights groups for violating users' privacy around the world and it faces lawsuits from major tech firms such as Apple and Microsoft.
The revelation that Spain’s top leader’s phone was hacked comes just two weeks after the research institution Citizen Lab revealed that the phones of at least 63 Catalan separatists were also attacked by Pegasus – the largest known cluster of infections to date.
Pere Aragones, the separatist Catalan regional president, said on Monday in a statement: "When the mass surveillance is against the Catalan independence movement, we only hear silence and excuses. Today everything is done in a hurry.
"But the double standard here is clear. It seems that against the independence movement anything is accepted."