Doha – The General Directorate of Information Systems Security (DGSSI) has concluded its investigation into the recent data breach initially reported on June 2.
According to an official statement released on Friday, the compromised data originated exclusively from the tawtik.ma platform, which is used by the National Council of Notaries.
The DGSSI has clarified that contrary to earlier reports, the systems of the National Agency for Land Conservation, Cadastre and Cartography (ANCFCC) were not compromised.
This statement aims to dispel confusion about the scope of the incident that has concerned users since reports first emerged.
As an immediate response, authorities took the tawtik.ma platform offline to identify and address the security vulnerabilities that led to the data exfiltration.
‘Exploiting vulnerabilities in inadequately protected computers’
Enhanced security measures have been implemented in accordance with DGSSI cybersecurity recommendations, with additional proactive actions deployed to prevent future incidents.
The incident gained attention when the Algerian hacking group “Jabaroot” claimed responsibility for the attack on June 2.
The group alleged they had stolen approximately 10,000 property ownership certificates, 20,000 personal documents including sales deeds, civil status documents, ID cards, passports, and banking records. They claimed the breach amounted to 4 terabytes of data.
This attack follows a similar breach in April when the same group targeted Morocco’s National Social Security Fund (CNSS), exposing personal data of nearly 2 million Moroccan employees across approximately 500,000 businesses.
The CNSS later stated that many of the leaked documents were “often false, inaccurate or truncated.”
Sources from ANCFCC had previously denied that their systems were directly compromised. As reported by Le360, an authorized source from the agency stated that no intrusion or data leak was detected in their information system.
The source suggested the hackers may have accessed data on the notaries’ platform by “exploiting vulnerabilities in inadequately protected computers.”
The Jabaroot group justified their attack as a response to what they called “Moroccan media’s false propaganda” regarding rumors about France freezing assets belonging to high-ranking Algerian officials.
They described this alleged propaganda as “an unjustified intervention and an opportunistic way to attack Algeria again on the international stage.”
Morocco faces growing cybersecurity threats
Documents leaked by the group reportedly included sensitive information of Moroccan officials. The group specifically claimed to have released documents belonging to senior officials, including alleged documents of Mohamed Yassine Mansouri, the director general of foreign intelligence.
Cybersecurity experts have warned citizens not to open any of the leaked files circulating online, as they may contain security threats that could compromise personal data.
This incident occurs amid increasing cybersecurity concerns in Morocco. In April, cybersecurity company Kaspersky reported that Morocco ranks third among African countries facing web-based threats, with 12.6 million attack attempts documented in 2024.
Kenya leads with nearly 20 million incidents, followed by South Africa with approximately 17 million.
A string of recent cyberattacks targeting Moroccan institutions has exposed serious gaps in the country’s digital defenses.
Between June 1 and June 3, 2025, multiple attacks targeted various Moroccan institutions, including the Ministry of Health, Bank Al-Maghrib, Maroc Telecom, and several educational institutions.
Read also: Transparency Maroc: CNSS Data Breach Exposes Critical Flaws in Morocco’s Cybersecurity
