data breaches
Massive Hack Exposes Moroccan Welfare Records—FGD Calls for Urgent Government Probe
Opposition party calls for accountability and nationwide protest after hacker group Jabaroot leaks CNSS records, ministerial emails, and financial contracts allegedly exposing high-level corruption.
Rabat, Morocco — July 22, 2025 | By El Mostafa Ouchen
The Democratic Left Federation (FGD) has called for a comprehensive investigation and public accountability following the leak of thousands of documents allegedly obtained through a targeted cyberattack on Moroccan government systems.
The hacking group Jabaroot, based in Algeria, published files on encrypted messaging platforms and darknet forums claiming access to servers belonging to Morocco’s CNSS (Caisse Nationale de Sécurité Sociale) and several unnamed ministries. The data breach is one of the most serious digital intrusions in the country’s history.
“This is not only a violation of national sovereignty—it is a wake-up call about institutional opacity and digital vulnerability,” said Fatima Zahra Tamni, a leading FGD member.
🖥️ What Was Leaked: A Breakdown
Cybersecurity researchers and investigative journalists who reviewed portions of the dump confirm that the following categories of data were compromised:
| Category | Examples |
|---|---|
| CNSS Personal Data | Names, national ID numbers, social security details, salary history |
| Internal Government Emails | Communications between high-level officials, project approvals, memos |
| Financial Contracts | Infrastructure tenders, public procurement documents, undisclosed invoices |
| Ministerial Reports | Internal audits, unpublicized policy drafts, and inter-ministry assessments |
| Database Logs | Access records and system configurations from internal networks |
In one revealing document, government officials allegedly discussed redirecting funds meant for public housing projects to consulting contracts involving politically connected firms.
💻 How the Hack Happened: Technical Summary
According to experts, the breach likely occurred via a multi-stage intrusion between April and May 2025:
- Initial Access: Phishing emails with malware-laced attachments sent to mid-level CNSS employees.
- Privilege Escalation: Once inside, the attackers exploited a known Fortinet VPN vulnerability (CVE-2023-27997) to gain administrative access.
- Data Extraction: Files were exfiltrated over encrypted channels in small batches to avoid triggering security alerts.
- Public Dumping: The data was posted via Telegram channels, ZeroNet forums, and the dark web.
The Moroccan General Directorate for Information Systems Security (DGSSI) has not yet commented publicly, but internal sources confirm emergency meetings were held to assess the scope and potential response.
⚖️ Political Fallout and Civic Response
The FGD is demanding:
- A parliamentary commission to investigate all ministries affected
- An audit of digital security policies across public institutions
- Legal consequences for any officials found involved in misappropriation
Public sentiment is boiling over, with civil society organizations, journalists, and digital rights groups calling for a national reckoning.
“We cannot let cybercriminals define our truth—but we also cannot deny what these documents reveal,” said Samir Laâraj, a data transparency advocate in Rabat.
The #حاسبوا_الفاسدين (“Hold the corrupt accountable”) movement has gained over 100,000 mentions across Moroccan social media platforms in the past 48 hours.
🧭 Implications for National Security and Governance
This breach has opened Morocco to several parallel risks:
- Geopolitical exposure amid regional tensions with Algeria
- Loss of public trust in welfare and administrative systems
- Increased vulnerability to foreign intelligence exploitation
The cyberattack also raises new urgency for Morocco’s digital sovereignty, especially ahead of international events like AFCON 2025 and the 2030 FIFA World Cup, for which digital infrastructure plays a critical role.