At least 65 Catalan separatists were targeted including the region’s current leader, according to the report by Citizen Lab research centre at the University of Toronto cited by The New Yorker and Spanish daily El País.
The report said Pegasus spyware developed by Israel’s NSO Group had been installed on their phones.
Nearly all the phones were allegedly hacked between 2017 and 2020. The kind of espionage Madrid is accused of is illegal in Spain.
“We have been spied on in a huge and illegal manner through software that only states can possess,” ex-Catalan leader Carles Puigdemont tweeted.
“Politicians, lawyers and activists are all victims of the Spanish state’s dirty war,” he added.
Those targeted include present Catalan leader Pere Aragonès, who was deputy leader of the region at the time, ex-regional leaders Quim Torra and Artur Mas as well as members of the EU and Catalan parliaments and of independent civil society organisations.
Puigdemont, who escaped to Belgium after an attempt by the region to gain independence through a 2017 referendum, was not one of those targeted but several people close to him were, including his wife, Citizen Lab said.
The Spanish government did not respond to requests for comment.
The president of the Catalan regional parliament, Roger Torrent, in July 2020 accused Spain of spying on him with Pegasus software but Madrid denied the claim.
“The Spanish government must give immediate explanations and get to the bottom of the matter,” Aragones tweeted in English on Monday.
Catalonia in northeast Spain has been at the centre for several years of a political crisis between separatists, who control the executive and the regional parliament, and the central government in Madrid.
Tensions have eased following the start of talks in 2020 between separatists and the Socialist government under Spanish Prime Minister Pedro Sanchez after he pardoned nine jailed separatist leaders.
Pegasus, which can switch on a phone’s camera or microphone and harvest its data, was at the centre of a storm last year after a list of about 50,000 potential surveillance targets worldwide was leaked to the media.