And yet another debacle in the Moroccan security services. A group calling itself Jabaroot posted four spreadsheets on Telegram on August 24 listing roughly 70,000 people it described as members of Morocco’s security and intelligence services, according to Le Monde, which reviewed the files. Spanish outlets put the exact count at 70,381 records drawn from two agencies, per La Razón. The material has not been authenticated by any government.
The two agencies named are the General Directorate of National Security, or DGSN, which runs Morocco’s national police, and the General Directorate for Territorial Surveillance, the DGST, which handles domestic intelligence and counterterrorism. Both report to the same man, Abdellatif Hammouchi, an unusual concentration of authority that has made him the most powerful security official in the kingdom.
What the files contain
The spreadsheets carry service identification numbers and identity card numbers, along with bank account details. Recruitment dates and dates of birth are also listed, and the main file mixes DGSN and DGST personnel rather than separating them. Among the entries are regional directors and department heads whose listed portfolios cover counterespionage and operational budgets. Hammouchi’s date of birth, October 7, 1966, had not previously been public, an indication that at least some of the material did not come from open sources.
Several signals point to aging data. The most recent recruitment date recorded anywhere in the files is 2020, and some of the people listed are dead, including Abdelhak Khiame, the first director of the Central Bureau of Judicial Investigation, who died in 2022 (Le Monde). European security services examining the material consider the names genuine but outdated, according to El Mundo. Former Moroccan intelligence officers contacted by El Confidencial validated the contents, as reported by Ara.
Competing accounts of where the data came from
Jabaroot claims a deep intrusion into both services and says the published files represent a fraction of what it holds (Escudo Digital). Jabaroot also published a file in April 2026 that it said contained data on more than three million CNOPS members, the public-sector health insurance fund which hold personnel data on state employees generally.
Media sources say the August 24 release was carried out by five former DGST personnel, four officers and a police commissioner, who broke with the service and went into exile in Europe seeking changes at the top of Morocco’s security establishment.
Attribution of Jabaroot itself remains unresolved. Rabat has pointed to Algeria, while European services reject that origin, and the cybersecurity firms CybelAngel and Zecurion separately traced the alias to a probable computer engineer who identifies as Tunisian and lives in Germany (El Mundo). Jabaroot has struck Moroccan institutions before, beginning in April 2025 with a dump of records from the National Social Security Fund that exposed salaries and personal data across the formal economy (Resecurity).
The Ceuta connection
The release is branded #OP_CEUTA, tying it to the July 30 border breach at the Spanish enclave of Ceuta, when as many as 70,000 people crossed from Morocco and several of them died in the first days. The confirmed toll later rose above 70 (The North Africa Journal). Jabaroot presents the leak as a “gift to Europe and, in particular, to Spain,” and asserts that Moroccan migration toward Europe is state policy. It says it holds mission orders showing Moroccan agents traveled to the border area before the breach to coordinate it, naming Hammouchi and royal adviser Fouad Ali El Himma (El Mundo). Moroccan authorities have denied encouraging the crossings, attributing them to smuggling networks and rumors about relaxed controls.
From Our Perspective
For Madrid the timing is awkward. Interior Minister Fernando Grande-Marlaska decorated Hammouchi with the Grand Cross of the Order of Merit of the Civil Guard in November 2025, months before Spain’s National Court shelved its Pegasus investigation into the phone hacking of Prime Minister Pedro Sánchez for a second time, citing Israel’s refusal to cooperate. Rabat’s silence is the most telling element so far. Neither directorate had commented as of midweek, which leaves the hackers’ framing unchallenged in European capitals where the files are already being read.
Two things deserve separating. The insurance-records explanation, if accurate, limits the technical damage and suggests Morocco’s intelligence networks were never breached. It does not reduce the counterintelligence exposure, because a list of names attached to identity numbers and recruitment years still allows a foreign service to reconstruct who joined which agency and when, and stale data ages slowly in that trade. Officers named in a 2020 file are mostly still serving.
The escalation to watch is the mission orders. Personnel data embarrasses Rabat. Documentary evidence of an orchestrated border operation would push the story into Spanish and EU institutional terrain, where the Ceuta deaths are already contested. Jabaroot has an incentive to promise more than it holds, and its Pegasus teaser hints at that. Whether the group can deliver will determine if this remains a large data breach or becomes a diplomatic case.
