A major cyberattack by the Jabaroot group has exposed personal data of Moroccan officials. The leak coincides with the Ceuta migration crisis and raises new questions about internal security and political struggles.
Morocco is grappling with a persistent cyberwar that has shaken its security institutions and now intersects with the ongoing migration crisis in Ceuta. Since 2025, the hacker group Jabaroot has targeted Moroccan government systems, culminating this week in the release of personal data for over 70,000 alleged Moroccan intelligence agents. The timing of the leak, amid heightened tensions over the mass entry of migrants into Ceuta, has triggered a wave of concern in Spain and across Europe.
While Moroccan media has largely remained silent, the Jabaroot group—initially linked to Algeria—has escalated its campaign by threatening further disclosures. Among the leaked data are names of senior officials from the Directorate General of Territorial Surveillance (DGST) and the Directorate General of National Security (DGSN), including Abdelatif Hamuchi, a key figure close to King Mohamed VI. The Moroccan government, through its DGSN-DGST Security Unit, has denied any breach of its core databases, attributing the leak to old insurance and social security files and insisting that its own systems remain secure under strict cybersecurity protocols.
Jabaroot has framed its actions as a direct message to Spain, claiming to possess unreleased information about the July 30–31 migrant influx into Ceuta. The group’s Telegram channel, used to publish the leaks, was shut down after 72 hours, but new threats and claims continue to circulate online. One notable claim is that Jabaroot holds communications between Moroccan officials allegedly orchestrating the mass entry into Ceuta. The group has also referenced the Pegasus spyware case, raising questions about Morocco’s possible involvement in hacking the phones of Spanish Prime Minister Pedro Sánchez and several ministers during a previous diplomatic standoff.
The leaked spreadsheets contain varying details, from full names and ID numbers to payroll records, police or intelligence ranks, bank account codes, and recruitment dates. French newspaper Le Monde, after analyzing the data, identified regional directors and department heads among those listed, suggesting the source may be a payroll department. According to Le Monde, five former DGST agents, now exiled in Europe, are behind the leak and are demanding changes in Morocco’s security leadership. However, verifying the authenticity of the list is complicated by the inclusion of deceased individuals and the outdated nature of some records.
The scale of the leak has fueled misinformation on social media, with some anonymous accounts falsely linking names from the list to past terrorist attacks. For example, the name Mohamed Bouharrat appeared in both the leaked files and the 2007 Madrid train bombing trial, but fact-checkers later confirmed these were different individuals.
Jabaroot first emerged as a major threat in April 2025, quickly expanding its attacks from traffic fines and property records to the payrolls of royal officials. Last year, the group claimed to have breached the Ministry of Justice, accessing confidential data on Minister Abdelatif Uahbi and thousands of magistrates and civil servants. Uahbi, now leading Morocco’s response to the Ceuta crisis and campaigning for the upcoming legislative elections, has demanded Spain return all unaccompanied Moroccan minors from Ceuta, a city whose sovereignty is contested by Rabat.
Jabaroot also boasted of obtaining millions of documents, including property transactions implicating public figures in alleged tax evasion. The National Agency for Property Conservation denied any breach of its archives, attributing the leak to a notary platform that was subsequently closed. Government spokesperson Mustafá Baitas blamed “hostile actors” abroad, while Uahbi described the attacks as an internal power struggle manipulated by foreign interests.
Morocco’s cyberwar is not one-sided. The hacker collective Phantom Atlas, believed to be Moroccan, announced in mid-2025 that it had infiltrated Algeria’s banking and telecom systems, publishing evidence of access to sensitive financial and administrative data. These counterattacks highlight the broader digital conflict between Morocco and Algeria, with both sides targeting critical infrastructure and sensitive information.
The Ceuta crisis has already exposed deep divisions within the Spanish government, as highlighted in a recent report on cabinet tensions over Morocco policy. The latest cyberattacks add another layer of complexity, raising questions about the security of official data and the potential for further destabilization in the region.
For context, Ceuta is a Spanish autonomous city on the North African coast, often at the center of migration and diplomatic disputes between Spain and Morocco. The ongoing cyberwar underscores the vulnerability of state institutions to digital threats and the growing intersection between cybersecurity and geopolitical tensions in the Mediterranean.
