A new assessment of the Pegasus spyware attack on Spanish President Pedro Sánchez has revealed the extraordinary scale of information extracted from his cellphone, reigniting questions about who was behind the operation and what may have happened to sensitive government data.
Spain’s National Intelligence Centre, known as the CNI, has acknowledged that Pegasus extracted approximately 2.7 gigabytes of data from Sánchez’s phone during the 2021 cyberattack.
To illustrate the enormous volume of information represented by that amount of data, the CNI estimates it could correspond to roughly 5 million text messages, 100,000 emails, 1,200 photographs or 40 hours of recorded audio, according to reports published in Spain.
A Spyware Attack on the President
Sánchez’s phone was compromised by Pegasus in May 2021, with investigators determining that approximately 2.6 gigabytes of information were extracted during the first attack and another roughly 130 megabytes during a subsequent intrusion.
The phone of then-Defense Minister Margarita Robles was also targeted.
The Spanish government said at the time that the attacks were external and had not been authorized by Spanish authorities. But the identity of the person or organization responsible for the attacks has remained a major unresolved question.
Pegasus, developed by Israeli technology company NSO Group, is among the world’s most sophisticated commercial surveillance tools. Once a device is successfully compromised, attackers can potentially gain access to highly sensitive communications and information stored on the phone.
For a sitting president, that could include private conversations, diplomatic communications, government documents, photographs, contacts and information involving national-security matters.
One of the most troubling questions surrounding the case is not simply how much data was extracted, but what the attackers obtained.
Spanish authorities have previously acknowledged that forensic investigators could establish the amount of data removed from the devices but could not necessarily determine exactly which documents or pieces of information were taken.
That means the 2.7-gigabyte figure provides an indication of the scale of the breach without answering the more consequential question: What did the attackers actually see?
The uncertainty has fueled political controversy in Spain and prompted renewed scrutiny of the government’s handling of sensitive communications.
The Timing Added to the Controversy
The Pegasus attacks occurred during a period of intense diplomatic tension between Spain and Morocco.
The first compromise of Sánchez’s phone occurred in May 2021, around the same period as the diplomatic crisis surrounding Brahim Ghali, the leader of the Polisario Front, who entered Spain for medical treatment.
Thousands of immigrants subsequently crossed from Morocco into the Spanish city of Ceuta, producing one of the most serious border crises Spain had experienced in years.
Spanish investigators have examined the broader circumstances surrounding the spyware operation, but the existence of a temporal connection does not by itself establish who ordered or carried out the cyberattack.
The Spanish case illustrates a problem facing governments around the world: a compromised device belonging to a head of government could potentially expose information involving foreign policy, military planning, intelligence operations, diplomatic negotiations and communications with other world leaders.
That makes the Pegasus episode more than a Spanish political scandal. It is a reminder of the vulnerabilities facing government officials in an era in which sophisticated spyware can target mobile devices without the victim necessarily realizing that the phone has been compromised.
And despite years of investigation, one critical question remains unanswered:
Who obtained the information from Pedro Sánchez’s phone — and what did they do with it?
About The Author