The phones of Spanish Prime Minister Pedro Sanchez and Defence Minister Margarita Robles were tapped using Pegasus spyware in an "illicit and external" intervention, Madrid has said.
The minister of the presidency Felix Bolanos demanded “justice to investigate” the alleged breach of privacy using the Israeli-made spyware.
Pegasus spyware infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.
"It is not a supposition, they are facts of enormous gravity," Mr Bolanos said.
"We are absolutely certain that it was an external attack ... because in Spain, in a democracy like ours, all such interventions are carried out by official bodies and with judicial authorisation.
"In this case, neither of the two circumstances prevailed, which is why that we have no doubt that it was an external intervention. We want the justice to investigate.”
Mr Bolanos did not say whether the Spanish authorities had any indication from where the alleged attack had originated or whether another country was behind it.
Mr Sanchez’s phone had been tapped in May 2021, as Ms Robles’s was the following month, he said.
"A determined amount of data" was extracted from both phones, Mr Bolanos said.
"There is no evidence that there was other tapping after those dates."
The Israel-based NSO Group, which owns Pegasus, claims the software is sold only to government agencies to use on criminals and terrorists, and subject to the approval of Israeli authorities.
The company has been criticised by human rights groups for violating users' privacy around the world and faces lawsuits from big tech firms such as Apple and Microsoft.
Catalan separatists have accused Spain's intelligence services of using spyware to snoop on their mobile phones, reviving tensions with Mr Sanchez's minority leftist government, which relies on their support to pass legislation.