Cyber attack in Morocco: 70,000 intelligence operatives exposed by Jabaroot
The hacker group Jabaroot has published personal data of nearly 70,000 members of Moroccan security services active in Europe. An internal settling of scores or an Algerian offensive?
Personal data of 70,000 Moroccan operatives revealed on Telegram
On Monday 24 August, a new file of personal data was circulated on Telegram under the banner of the hacking group Jabaroot. As reported by La Libre, the information concerns nearly 70,000 people belonging to the security and intelligence forces of the Kingdom of Morocco — operatives whom Jabaroot claims are active in Europe.
The scale of the figure sparked speculation about the existence of tens of thousands of Moroccan spies on the European continent. Moroccan authorities, however, temper this interpretation: given their number, these files likely contain, indiscriminately, administrative personnel, officials and actual intelligence operatives.
Moroccan authorities deny any intrusion
The DGSN-DGST unit — the Directorate General of National Security and the Directorate General of Territory Surveillance — responded with a statement sent to the official news agency MAP. "The personal data recently published in no way result from an intrusion into [our] security systems," the statement says. "These are old data that were downloaded from databases and information systems managed by insurance companies and social security and health coverage organisations."
The files moreover date from 2020, which limits their immediate operational relevance.
A group with unclear contours since April 2025
Jabaroot first became known in April 2025, under the name JabarootDZ, with the hacking of data from the Moroccan National Social Security Fund (CNSS). Since then, the original account, which communicated in English, has been closed. Two new channels took over: "@jabaroot_off" and "@Jabaroot_1", which now publish in French and Arabic.
These accounts regularly claim to have disclosed stolen data from various Moroccan public institutions: the Ministry of Employment, the Ministry of Agriculture, the Tawtik notarial platform, the ANCFCC land registry system, the Ministry of Justice, the Royal Palace and the Moroccan Football Federation (FRMF).
However, nothing makes it possible to establish with certainty that all of these publications come from a single group. Continuity is far from guaranteed.
The Algerian lead receding, the internal settling-of-scores thesis taking centre stage
A notable change accompanied the group's evolution: the abandonment of the "DZ" mention, an abbreviation for "DjaZaïr", Algeria in Arabic. This mention initially suggested an Algerian origin, in a context of conflictual relations between Algiers and Rabat.
Publications attributed to Jabaroot since summer 2025 repeatedly target the same individuals: Abdellatif Hammouchi, head of the DGST-DGSN unit, and Fouzi Lekjaa, president of the FRMF. These repeated attacks fuel another hypothesis — that of an internal settling of scores within Morocco — which the erasure of the "DZ" mention lends credence to.
In June 2025, Jabaroot also accused the DGST of being behind a disinformation operation targeting Crown Prince Moulay Hassan, according to Spanish investigative journalist Ignacio Cembrero. However, a group linked to Algeria would have no interest in publicly defending the prince.
As early as December 2025, the newspaper Le Monde already raised rumours of five to six former Moroccan security operatives, who had taken refuge in Europe after conflicts with their hierarchy, seeking to take revenge. The French newspaper goes further today: "Four officers and a police commissioner who broke with the 'service' and went into exile in Europe" are reportedly demanding the head of Abdellatif Hammouchi.
The attribution of cyber attacks, a perilous exercise
Identifying the true origin of a cyber attack remains extremely complex. Data can be hacked and then resold on the Darknet to a third-party group that will distribute it accompanied by political claims. States can also commission attacks via apparently independent groups — "proxies" — to discredit an adversary without directly exposing themselves.
For example, it is another entity, "Keymous +", affiliated with the paid service EliteStress — which offers to take down any website of one's choice for payment — that claims the greatest number of verified cyber attacks against Morocco. This group accompanies its actions with a particularly variable political discourse.
In this landscape of modern cyber activism in constant reconfiguration, determining with precision who is acting, for what purpose and on whose behalf becomes an increasingly difficult task.
Source: La Libre