A US private investigator has told BBC News he was paid by the Sun newspaper to obtain personal information about the Duchess of Sussex in the early days of her relationship with Prince Harry.
But Daniel Hanks says he unlawfully accessed detailed information including Meghan's social security number.
The Sun's publisher said it requested legitimate research and instructed Mr Hanks he must act lawfully.
Meghan and Harry said it was a "moment of reflection" for the media industry.
BBC News has seen the so-called "comprehensive report on Meghan and her family" which the investigator, also known as Danno Hanks, passed to the Sun.
It included her phone number, addresses and social security number as well as information on her family members. His report also included information on her ex-husband and a former boyfriend.
In the US, licensed private investigators are allowed full access to databases of personal information for some permitted reasons such as court reports. But accessing this additional level of detail for journalistic purposes is unlawful.
Mr Hanks said: "Pretty much everything I found out they could find out themselves using legal means - with the exception of the social security numbers.
"When you have that information… it's the key to the kingdom."
While there is no evidence it happened in this instance, social security numbers in particular could potentially be used to further other intrusive investigations.
A spokesman for Harry and Meghan said: "The Duke and Duchess of Sussex feel that today is an important moment of reflection for the media industry and society at large, as this investigative report shows that the predatory practices of days past are still ongoing, reaping irreversible damage for families and relationships.
"They are grateful to those working in media who stand for upholding the values of journalism, which are needed now more than ever before."
The duke and duchess have had a fraught relationship with the UK's tabloid press. During the couple's recent interview with Oprah Winfrey, they said this had created a "toxic environment" of "control and fear" and was largely to blame for them leaving the UK.
Prince Harry is currently suing the publisher of the Sun, and the former publisher of the Daily Mirror, over allegations of phone hacking before 2011.
Several stories appeared in the Sun, and other newspapers, at the beginning of the couple's relationship. They included an article claiming Prince Harry had "bombarded" his future wife with text messages and another detailing a weekend they spent together at Meghan's home in Toronto.
Who is Danno Hanks?
Danno Hanks worked as a private investigator in the US for over 40 years gathering information on celebrities and high-profile people including Michael Jackson and Jeffrey Epstein.
He achieved some notoriety in the 1990s via appearances on daytime television and has been jailed four times, most recently in 2017 for extortion.
Mr Hanks said he had provided reports for most of the British tabloid newspapers.
He said the Sun wrote to him after the Leveson Inquiry into press standards and asked him to sign documents, seen by the BBC, committing to act within the law and he repeated this assurance when he billed the Sun for his work.
But he claims no-one ever asked where he got his information. "They didn't care. They just wanted the information," he said.
Mr Hanks came forward after being approached by Graham Johnson, a freelance journalist and editor of Byline Investigates, which publishes stories on the British media.
Mr Johnson, a former investigations editor at the Sunday Mirror, pleaded guilty to two counts of phone hacking in 2013.
His website has received money from prominent supporters of press reform, including actors Hugh Grant and Steve Coogan, who were both victims of phone hacking, and his partner Emma Jones is on the board of Hacked Off, the press reform campaign group.
Mr Johnson, who paid Mr Hanks for access to his documents, said: "This story definitely sticks out in the post-Leveson world because it has taken place five years after we thought these practices had stopped."
Most victims of phone-hacking have settled their claims. Prince Harry hasn't. That's the vital context of this story.
In the course of nearly a year reporting on the complex, often fraught relationship between the monarchy and the media, it's become clear that he is, in an important sense, the last man standing among those victims.
A News UK source told me that it was a "huge priority" and "preoccupation" for the company to repair relations with the royals after the severe damage done by the hacking revelations.
But the revelation that the Sun paid a private investigator to supply information on Meghan and her family, and that too in the period leading up to Prince Harry's bombshell public statement of 8 November 2016 in which he said a line had been crossed, will not improve relations.
Prince Harry has been advised by many people both to make peace with Britain's tabloids, and to settle his claims against them. He hasn't. He may strike some journalists as an unlikely champion of press reform. But it is a role he seems keen on.
Mr Hanks, who has now retired, said watching Harry and Meghan's interview with Oprah had also prompted him to speak out.
"I'm just doing it to clear my conscience," he said.
Asked what he would say to Meghan and Harry directly, he said: "I'm deeply sorry for what I did... and I'm available if your lawyers need to talk to me. I'm ready to give you what I know. Supply you with any information. I just wish this had never happened."
In a statement, News Group Newspapers - publishers of the Sun - said: "In 2016, the Sun made a legitimate request of Mr Hanks to research contact details and addresses for Meghan Markle and possible relatives using legal databases which he had a license to use. He was paid $250.
"Mr Hanks was not tasked to do anything illegal or breach any privacy laws - indeed he was instructed clearly in writing to act lawfully and he signed a legal undertaking that he would do so.
"The information he provided could not and did not raise any concerns that he had used illegal practices to obtain the information.
"At no time did the Sun request the social security number of Meghan Markle, nor use the information he provided for any unlawful practice.
"The Sun abides by all laws and regulations and maintains strict protocols in relation to the obtaining of information from third parties. Strict compliance is in place to cover all our reporting."