Jabaroot: The Mystery Hacker Behind Morocco's Biggest Data Leaks 2026

Jabaroot, an unidentified hacker or group of hackers, is responsible for the largest data leak in Moroccan intelligence history, exploiting political tensions to expose sensitive information. For over a year, this collective has breached numerous Moroccan institutions, with each leak timed to coincide with moments of political stress, the latest being the migrant entry into Ceuta.

What Happened: The Jabaroot Data Leaks

Jabaroot first appeared on April 8, 2025, claiming responsibility for an attack on Morocco's National Social Security Fund (CNSS) via BreachForums and Telegram. According to cybersecurity firm CybelAngel, the leak included over 53,000 PDF files and two large CSV datasets covering about two million employees and nearly half a million companies.

The exposed data included salaries, identification numbers, and bank details, mostly in plain text. The group framed the attack as retaliation for the prior hacking of the X account of the Agency for Digital Development (ADD).

Why It Matters: The Scale and Sensitivity of the Breach

The CNSS leak is just one in a series of attacks. Jabaroot has also leaked judicial files and, most recently, the personal data of tens of thousands of Moroccan intelligence agents. This represents a significant blow to national security, as it compromises the identities of undercover operatives.

The timing of the leaks is particularly concerning. Each release has occurred during periods of political tension, such as the Ceuta migrant crisis, suggesting a deliberate attempt to destabilize the Moroccan government and sow public distrust.

Who Is Affected: Citizens, Companies, and Intelligence Agents

Millions of Moroccan citizens and businesses have had their personal and financial data exposed. Employees whose salaries and bank details were leaked face risks of identity theft and financial fraud. Companies whose data was compromised may suffer reputational damage and legal liabilities.

Intelligence agents are at even greater risk. The leak of their personal information could endanger their safety and the safety of their families, and compromise ongoing operations. The background to this story is set out in London Transport Hackers Jailed for 'Keys to the Kingdom' Attack. A related thread runs through AI Cybersecurity Shift: 1,200 Websites Attacked, 100 Breached. Earlier coverage in Asos Data Breach: Hacker Accessed Customer Data via Trusted Contact shows how the argument developed.

What to Watch Next: The Hunt for Jabaroot and Morocco's Response

Moroccan authorities have not yet publicly identified Jabaroot, and it remains unclear whether it is a lone hacker or a coordinated group. The government is likely to intensify its cybersecurity efforts and may seek international assistance to track down the perpetrators. A closer look at the same subject appears in 16-Year-Old Hacker Exposes Microsoft's Titan Data Breach. Anyone following the wider picture can start with Ariana Grande Sues Hackers Over Leaked Unreleased Music and. The same theme surfaces in AI Breaks Cybersecurity Barriers: Hackers Get Hacked by AI, which takes a different angle.

Meanwhile, Jabaroot continues to operate with impunity, and further leaks are expected. The group's ability to evade detection and strike at will highlights the vulnerability of Morocco's digital infrastructure. Context on how this played out before sits in OpenAI AI Agent Breaches Medicare: Australia's Cybersecurity Wake-Up. A companion piece, AI Hacking Threats Spark 'Black October' Cybersecurity Alarm, approaches the same subject from another angle.

Key Takeaways

• Jabaroot is an unidentified hacker collective responsible for multiple data breaches in Morocco.
• The group leaked sensitive data from the CNSS, judicial files, and intelligence agents' personal information.
• Leaks are timed to coincide with political tensions, such as the Ceuta migrant crisis.
• Millions of citizens and businesses are affected, with risks of identity theft and financial fraud.
• Moroccan authorities have yet to identify or apprehend the perpetrators.

Comparison of Major Jabaroot Leaks