Morocco's social security fund CNSS had data on nearly 2 million people leaked

Morocco's Caisse Nationale de Sécurité Sociale, the national fund that administers healthcare, disability and retirement benefits for private sector workers, was hit by a data leak in April 2025 that researchers described as the largest publicly reported in the country.

A group operating under the name JabaRoot DZ posted the material on the BreachForums cybercrime forum and on a Telegram channel from 8 April 2025. The dump comprised more than 54,000 PDF files of salary declarations plus spreadsheets covering close to 500,000 registered employers. Analysts who examined it counted personal records for about 1,996,000 people, containing names, national identity numbers, passport details, email addresses, phone numbers, salary figures and bank account information. The archive carried timestamps from 29 November 2024, so the intrusion may have predated publication by months.

CNSS confirmed it was investigating and said some of the circulating material appeared misleading, inaccurate or incomplete. Morocco's Ministry of Economic Inclusion, whose website was also targeted, said no confidential data had been taken from it. Researchers suggested the entry point may have been a zero day or a flaw in third party software.

The group framed the leak as retaliation for Moroccan hackers seizing the Algerian Press Service's account on X, tying it to long running tensions between the two countries. Analysts noted the data was published rather than sold and no ransom was demanded, which points to a political rather than a financial motive. A Moroccan group calling itself Phantom Atlas claimed reprisal attacks on Algerian government systems days later.