| Formation | April 2025 |
|---|---|
| Type | Hacker group / hacktivist alias |
Region served | Morocco |
| Affiliations | Self-described Algerian; attribution disputed |
Jabaroot (also styled JabaRoot DZ or Jabaroot DZ) is the name used since April 2025 by a cyberthreat actor, or possibly a succession of actors, that has claimed responsibility for a series of intrusions and data leaks affecting public institutions in Morocco. The alias presents itself as Algerian and has distributed material mainly through Telegram channels and cybercrime forums.
Its first known operations, in April 2025, were the defacement of a Moroccan ministry website and the publication of data attributed to the National Social Security Fund (CNSS), an incident the security firm Resecurity described as potentially the largest cyberattack in Morocco by number of people affected. Later claims concerned a notarial platform, the National Fund for Social Welfare Organizations (CNOPS), the Ministry of Justice, the road safety agency NARSA, a civil-status documents platform and personnel of the Moroccan security services. These claims were verified to differing degrees: in several cases the institution named denied any intrusion, or officials and analysts concluded that the material came from a third party or from earlier breaches.
The name is generally derived from the Arabic jabarūt, which may be rendered as "power", "might" or "domination". The first identity to attract attention used the form "JabaRoot DZ", incorporating "DZ", the country code for Algeria. Those behind the initial operation described themselves as "Algerian patriots" and presented their actions as a response to Morocco.
The alias first appeared on 8 April 2025 on the cybercrime forum BreachForums and on Telegram, where its channel quickly gained several thousand subscribers. The original channel later disappeared and accounts using the same name subsequently emerged, with changes in tone and language; commentators have noted that there is therefore no certainty that those now publishing as Jabaroot are the people responsible for the April 2025 operation.
The alias emerged during a period of heightened tension in Algeria–Morocco relations. Jabaroot presented its first operation as retaliation for the hijacking of the Algérie Presse Service account on X, which it attributed to actors linked to Morocco; the account had been renamed before the platform suspended it.
On 8 April 2025, the website of the Ministry of Economic Inclusion, Small Enterprise, Employment and Skills was defaced. The ministry initially played down the incident, saying the information on the site was public; the actor responded by releasing an archive it presented as ministry payroll records.
The same day, a large volume of data attributed to the CNSS was posted on a dark web forum. According to analyses by Resecurity and CybelAngel, the dataset comprised more than 53,000 PDF files and two CSV files, containing records on hundreds of thousands of companies and close to two million employees, with material dated as recently as November 2024. Reported figures for the number of companies concerned varied between roughly 40,000 and 500,000 depending on the source and on how the files were counted. The exposed fields included names, national identity and passport numbers, contact details, declared salaries and bank account information. Resecurity noted that the data was published rather than offered for sale.
The CNSS confirmed that its security systems had been circumvented, said preliminary checks showed the circulating documents to be "often false, inaccurate or truncated", and opened an internal investigation without attributing the attack to a named actor.
On 2 June 2025, the actor claimed to have breached the National Agency for Land Registry, Cadastre and Cartography (ANCFCC) and to hold more than ten million documents. The ANCFCC denied that its database had been compromised and suspended access to its online services as a precaution, temporarily reverting to in-person filing. Morocco's General Directorate of Information Systems Security (DGSSI) subsequently stated that the data originated from Tawtik, the notarial digitisation platform operated by the National Council of the Order of Notaries, and that the land registry databases had not been penetrated. Specialists consulted by Yabiladi observed that the leaked material consisted of notarial instruments (deeds, powers of attorney and company formation records) rather than land titles, and that its volume was likely to be far smaller than claimed.
On 9 June 2025, the actor announced that it had accessed the information systems of the Ministry of Justice, claiming to hold data on around 5,000 magistrates and some 35,000 justice-sector employees. On 11 June the ministry denied that its information systems, databases or digital services had been compromised. Shortly afterwards the actor claimed a leak concerning the National Road Safety Agency (NARSA).
In July 2025, further documents apparently originating from Tawtik were published, concerning property transactions involving ministers from the Authenticity and Modernity Party. The absence of accompanying land titles limited independent verification. In August 2025, a Moroccan police officer filed a complaint over allegations made about him by an account using the Jabaroot name.
On 8 April 2026, a year after the CNSS leak, the actor claimed an intrusion into CNOPS, the health insurance fund for public servants, asserting that it had extracted "three million lines" of data. A file examined by Le360 contained information on close to one million people presented as members, including names, affiliation numbers, identity documents and addresses. The president of the National Commission for the Control of Personal Data Protection (CNDP), Omar Seghrouchni, said the matter was under investigation and referred to "a political agenda" behind the action. CNOPS did not publicly confirm the intrusion.
In May 2026, the actor claimed to have obtained more than 695,000 records linked to Watiqa.ma, the Moroccan online platform for requesting civil status documents. The claim was not independently verified and received no official confirmation.
In the days before its largest publication, the account threatened to reveal the identities of Moroccan security agents and briefly disappeared from Telegram. On 24 August 2026, under the banner "OP_CEUTA", files were published on Telegram presented as containing the personal details of 70,381 members of the General Directorate of National Security (DGSN) and the General Directorate of Territorial Surveillance (DGST), including senior officials. The fields cited included names, dates of birth, identity numbers, year of recruitment, rank, payroll reference numbers and bank details. The publication was framed as a "gift" to Europe, and to Spain in particular, in the context of the large-scale entry of migrants into Ceuta at the end of July 2026.
The actor further alleged that Abdellatif Hammouchi, head of the DGSN and the DGST, and the royal adviser Fouad Ali El Himma had orchestrated the pressure on the Ceuta border, and stated that King Mohammed VI had not been informed. No evidence was provided for these allegations and they have not been independently corroborated. The DGSN–DGST pole denied that any breach of its information systems or secured databases had occurred and said the material derived from old insurance data.
The identity of those behind the alias remains unresolved. Moroccan authorities and much of the Moroccan press have pointed to Algeria, but this attribution has not been confirmed by independent technical evidence. The Cyber Security Incident Database catalogues Jabaroot DZ as an actor associated with Algeria while noting the absence of information on its internal structure, size or funding.
Several competing hypotheses have been advanced:
The provenance of the August 2026 material has also been questioned. According to Barlaman Today, Jeune Afrique reported that the files were not obtained by breaching DGSN or DGST systems and that the data came in part from records held by Saham Assurance and CNOPS, bodies that hold administrative information on public employees. Morocco World News reported that Médias24 found a large proportion of the names to belong to ordinary DGSN police officers and described the operation as "repackaging"- the recycling of previously compromised data presented as a new leak.
The April 2025 breach prompted debate over the resilience of Moroccan public digital infrastructure. Transparency Maroc expressed "profound concern", described the response of the institutions concerned as inadequate and opaque, invoked the constitutional protection of personal data and Law 09-08, and called on the government to publish the results of its investigations. The CNDP warned that data obtained outside a legal framework could not be accessed or exploited without breaching data protection law.
In September 2025, the CNSS allocated 40 million dirhams to strengthening its information security systems.
The August 2026 publication drew attention in Spain because of its timing relative to the Ceuta crisis. Spanish services were reported to be analysing the files to establish which identities corresponded to intelligence personnel, while the origin of the material remained under examination. The former director of Spain's National Intelligence Centre, Jorge Dezcallar, questioned on a national TV channel as to whether Morocco maintains an intelligence service of the size implied by the figure of 70,000 and, referring to the Ceuta crisis, said that Morocco had either looked the other way or acted with connivance.