Data leak on Moroccan institutions increases political tensions with Algeria

On April 8, 2025, threat actor Jabaroot, published confidential data extracted from National Social Security Fund of Morocco (CNSS) on BreachForums. The leaked dataset includes more than 53,000 files containing detailed records of nearly half a million companies and nearly 2 million employees. The documents include data such as company affiliations, employee identification numbers, salaries and contact information. In addition, most of the data appears to have been exposed in clear text on compromised servers.

According to statements made by actor Jabaroot, the CNSS leak appears to be motivated as a political response. Jabaroot claims that the attack was carried out in retaliation for an earlier attack on the X (old Twitter) account of Algerian Press Service, an event attributed to Moroccan-affiliated threat actors. In that incident, the account was renamed “Sahara Marocain”, a reference to the long-running geopolitical dispute between Morocco and Algeria over the Western Sahara region. That X account was subsequently suspended after extensive media coverage.

Shortly after announcing the CNSS leak, Jabaroot shared additional content on Telegram, including a screenshot purportedly showing a defacement on the Moroccan Ministry of Labor's website. The actor stated that this new attack was part of a larger campaign intended to respond to other incidents that had been carried out by Moroccan hacking groups against Algerian institutions.

This activity underscores how cyberattacks are increasingly being used as political messaging tools, blurring the lines between hacktivism and retaliation aligned with certain states in a regional context. Relations between Morocco and Algeria have remained tense and confrontational in recent years, marked by worsening political and territorial disputes. In August 2021, Algeria severed diplomatic relations with Morocco, resulting in the closure of airspace, the interruption of gas pipelines and the imposition of visas on Moroccan citizens.