Since 2025, the hacker group Jabaroot has targeted Moroccan government systems. This week, the campaign culminated in the release of personal data relating to more than 70,000 alleged Moroccan intelligence agents. The leak coincides with heightened tensions over the mass entry of migrants into Ceuta and has raised concerns in Spain and across Europe.
Moroccan media has largely remained silent as Jabaroot, initially linked to Algeria, escalates its campaign and threatens further disclosures. The leaked data include names of senior officials from the Directorate General of Territorial Surveillance (DGST) and the Directorate General of National Security (DGSN), including Abdelatif Hamuchi, a basic figure close to King Mohamed VI. Through its DGSN-DGST Security Unit, the Moroccan government has denied a breach of its core databases. It says the leak came from old insurance and social security files and insists its systems remain protected by strict cybersecurity protocols.
Jabaroot has framed its actions as a direct message to Spain, claiming to hold unreleased information about the July 30 and 31 migrant influx into Ceuta. The group’s Telegram channel, which it used to publish the leaks, was shut down after 72 hours. New threats and claims continue to circulate online. Jabaroot claims it holds communications between Moroccan officials who allegedly orchestrated the mass entry into Ceuta. The group has also cited the Pegasus spyware case, renewing questions about Morocco’s possible role in hacking the phones of Spanish Prime Minister Pedro Sánchez and several ministers during an earlier diplomatic standoff.
The leaked spreadsheets contain full names and ID numbers, along with payroll records. They also list police or intelligence ranks, bank account codes and recruitment dates. After analyzing the data, French newspaper Le Monde identified regional directors and department heads, suggesting the files may have come from a payroll department. Le Monde reported that five former DGST agents, now exiled in Europe, are behind the leak and are demanding changes to Morocco’s security leadership. The list’s authenticity is difficult to verify: it includes deceased individuals, and some records are outdated.
The scale of the leak has fueled misinformation on social media, where anonymous accounts have falsely linked names on the list to past terrorist attacks. The name Mohamed Bouharrat, for example, appeared in both the leaked files and the 2007 Madrid train bombing trial. Fact-checkers later confirmed these were different individuals.
Jabaroot emerged as a major threat in April 2025, expanding its attacks from traffic fines and property records to the payrolls of royal officials. Last year, the group claimed to have breached the Ministry of Justice and accessed confidential data on Minister Abdelatif Uahbi and thousands of magistrates and civil servants. Uahbi, now leading Morocco’s response to the Ceuta crisis and campaigning in the upcoming legislative elections, has demanded that Spain return all unaccompanied Moroccan minors from Ceuta, a city whose sovereignty Rabat contests.
Jabaroot also boasted of obtaining millions of documents, including property transactions that allegedly implicate public figures in tax evasion. The National Agency for Property Conservation denied a breach of its archives and blamed the leak on a notary platform that was later closed. Government spokesperson Mustafá Baitas blamed “hostile actors” abroad, while Uahbi described the attacks as an internal power struggle manipulated by foreign interests.
Morocco’s cyberwar also extends beyond its borders. The hacker collective Phantom Atlas, believed to be Moroccan, announced in mid-2025 that it had infiltrated Algeria’s banking and telecom systems. It published evidence of access to sensitive financial and administrative data. These counterattacks point to a broader digital conflict between Morocco and Algeria, with both sides targeting critical infrastructure and sensitive information.
The Ceuta crisis has already exposed deep divisions within the Spanish government, as a recent report on cabinet tensions over Morocco policy highlighted. The latest cyberattacks add another layer of complexity, raising concerns about the security of official data and the risk of further regional destabilization.
Ceuta is a Spanish autonomous city on the North African coast, often at the center of migration and diplomatic disputes between Spain and Morocco. The ongoing cyberwar exposes how vulnerable state institutions are to digital threats and how cybersecurity increasingly overlaps with geopolitical tensions in the Mediterranean.
