In a troubling incident for Morocco's security apparatus, a hacker group known as Jabaroot has released a staggering amount of sensitive data on August 24, which includes details of approximately 70,000 individuals identified as members of the nation's intelligence and security services. This disclosure came to light through various media reports, including those from Le Monde and La Razón. Although the Moroccan government has yet to authenticate the data, the implications of this breach are significant, raising questions about the security of personal information within the country’s intelligence framework.
The leaked spreadsheets reveal a wealth of information, including service identification and identity card numbers, alongside financial details such as bank account information. The files also contain recruitment dates and birth dates of personnel, with a notable absence of separation between members of the General Directorate of National Security (DGSN) and the General Directorate for Territorial Surveillance (DGST). This extensive dataset includes high-ranking officials, with some entries detailing individuals responsible for critical areas such as counterespionage and budgetary oversight. Alarmingly, it also features Hammouchi's birth date, a detail that had previously remained undisclosed, suggesting that at least some of the data might not have been sourced from public records.
However, several indicators suggest that the information may be outdated. The latest recruitment date recorded in the files is from 2020, and a number of listed individuals are deceased, including Abdelhak Khiame, the former head of the Central Bureau of Judicial Investigation, who passed away in 2022. European security agencies that have scrutinized the leaked data consider the names to be authentic but outdated, as confirmed by El Mundo. Former members of Moroccan intelligence who were contacted have also validated the authenticity of the contents, indicating a mix of both current and obsolete data.
Jabaroot claims that the release is merely a fraction of what they have obtained, suggesting a significant breach of both the DGSN and DGST. The group has previously released data in April 2026, which reportedly included personal details of over three million members of the public-sector health insurance fund. The August 24 release is linked to a group of five former DGST personnel who have since sought asylum in Europe, with intentions to instigate change within Morocco's intelligence community.
The origins of Jabaroot remain ambiguous, with allegations of Algerian involvement being dismissed by European security experts. Investigations by cybersecurity firms have pointed towards a possible Tunisian computer engineer residing in Germany as the mastermind behind the group. Jabaroot's history of targeting Moroccan institutions started in April 2025 with a data dump from the National Social Security Fund, further indicating a pattern of cyber activism against Moroccan governance.
This data leak, codenamed #OP_CEUTA, is strategically tied to the tragic events that transpired at the Spanish enclave of Ceuta, where thousands attempted to cross the border from Morocco, leading to numerous fatalities. Jabaroot frames the leak as a “gift” to Europe, particularly Spain, and alleges that the Moroccan government orchestrated these crossings, implicating high-level officials such as Hammouchi and royal advisor Fouad Ali El Himma. Moroccan authorities have refuted these claims, attributing the crossings to smuggling networks and misinformation regarding border control measures.
From a diplomatic standpoint, the timing of this leak poses a challenge for Spain, particularly as Interior Minister Fernando Grande-Marlaska recently honored Hammouchi with a prestigious award. The silence from Moroccan officials regarding this breach speaks volumes, as it leaves the hackers' narrative unchallenged in European discussions. It is essential to differentiate between the implications of the leaked personnel data and the potential fallout from any documentary evidence of a coordinated border operation, which could elevate this situation from a mere data breach to a significant diplomatic crisis.
As reported by north-africa.com.
