Hackers leak records of 70,381 Moroccan security agents and allege state role in Ceuta border crossing

Intelligence files published online

A hacktivist group operating under the name Jabaroot published databases containing personal and administrative records belonging to 70,381 Moroccan security personnel. The leak covers members of the General Directorate for Territorial Surveillance (DGST), Morocco's domestic intelligence agency, and the General Directorate for National Security (DGSN), the national police force. The released files include full names, national identity card numbers, civil service employee identifiers, dates of birth, ranks, and recruitment years. A supplementary file contains bank identification details for 1,400 officers, alongside records for 21 intelligence directors, including security chief Abdellatif Hammouchi. Former Moroccan intelligence officers confirmed that the published material includes genuine personnel data, identifying active division heads such as the human resources director, the deputy counterintelligence director, and the head of the Investigation Unit.

Claims linking the state to the Ceuta border crossing

Along with personnel registries, Jabaroot released extracts of mission orders issued to Moroccan agents deployed to the border town of Castillejos during the mass entry into Ceuta on 30 July. The collective asserted that the migration push was an official state operation planned to exert pressure on Spain and European authorities. Jabaroot named royal advisor Fouad Ali el-Himma and Abdellatif Hammouchi as the coordinators of the movement, alleging that the operation occurred without the knowledge of King Mohammed VI, but with prior awareness in the United States and Israel. Spanish journalist Ignacio Cembrero evaluated the strategic consequences of the disclosure for Moroccan intelligence networks operating internationally.

It is a very, very useful gift, because all of a sudden you know who everyone is who works for Moroccan domestic intelligence.

Hacker identity and technical traces

Although Jabaroot claimed to represent Algerian patriots, European intelligence agencies suspect the collective is run by a single former Moroccan intelligence operative living in Germany. Technical investigations by French cybersecurity firm CybelAngel linked Telegram accounts used by the group to a GitHub developer profile registered under the handle 3N16M4. The group first gained attention in April 2025 by breaching the database of Morocco's National Social Security Fund before leaking information regarding royal palace personnel and properties. Cybersecurity analysts noted that the published files combine previously circulating registries with newer internal administration lists. Following the data release on Telegram and Russian hacking forums, the group posted messages inquiring about interest in Pegasus surveillance data relating to Spanish Prime Minister Pedro Sánchez.

Political ultimatums and regional reactions

Prior to publishing the personnel lists, Jabaroot presented several political conditions to authorities in Rabat. The collective demanded an official government apology for the Ceuta events, the declaration of a period of national mourning, and the cancellation of Morocco's legislative elections scheduled for 23 September. Moroccan authorities have not issued a formal public response to the data leak or the claims regarding the Ceuta border crossing. European intelligence agencies continue to examine the published records to evaluate Moroccan intelligence operations abroad, while bilateral diplomatic communications between Madrid and Rabat remain focused on border security management.