Morocco's Caisse Nationale de Sécurité Sociale, the national fund that administers healthcare, disability and retirement benefits for private sector workers, was hit by a data leak in April 2025 that researchers described as the largest publicly reported in the country.
A group operating under the name JabaRoot DZ posted the material on the BreachForums cybercrime forum and on a Telegram channel from 8 April 2025. The dump comprised more than 54,000 PDF files of salary declarations plus spreadsheets covering close to 500,000 registered employers. Analysts who examined it counted personal records for about 1,996,000 people, containing names, national identity numbers, passport details, email addresses, phone numbers, salary figures and bank account information. The archive carried timestamps from 29 November 2024, so the intrusion may have predated publication by months.
CNSS confirmed it was investigating and said some of the circulating material appeared misleading, inaccurate or incomplete. Morocco's Ministry of Economic Inclusion, whose website was also targeted, said no confidential data had been taken from it. Researchers suggested the entry point may have been a zero day or a flaw in third party software.
The group framed the leak as retaliation for Moroccan hackers seizing the Algerian Press Service's account on X, tying it to long running tensions between the two countries. Analysts noted the data was published rather than sold and no ransom was demanded, which points to a political rather than a financial motive. A Moroccan group calling itself Phantom Atlas claimed reprisal attacks on Algerian government systems days later.
Sources
- Morocco investigates major data breach allegedly by Algerian hackersThe Record
- Cybercriminals Attacked National Social Security Fund of Morocco: Millions of Digital Identities at Risk of Data BreachResecurity
- Sensitive PII of millions leaked in historic Moroccan data breachBiometric Update
- Our Investigation of the CNSS Data Leak: Flash ReportCybelAngel
- Moroccan government clarifies on data breach after Algerian hackers claim cyberattackHespress English
- Face the Consequences: Moroccan Hackers Strike Back at Algerian TargetsMorocco World News