Casablanca – An alleged massive data leak involving Morocco’s Office of Vocational Training and Employment Promotion, OFPPT, has triggered growing concern online after cybersecurity monitoring platforms reported that a database linked to the institution was being offered for sale on underground forums and the dark web.
According to threat intelligence accounts Dark Web Intelligence and VECERT Analyzer, a threat actor using the alias “anisanas2” claimed to have breached OFPPT’s database and released a free sample of 100,000 records as proof. The attacker alleged that the full dataset contains more than 400,000 entries, potentially affecting current trainees and graduates across Morocco.
🚨 NATIONAL SECURITY ALERT: MASSIVE LEAK OF EDUCATIONAL DATA (OFPPT – MOROCCO) 🇲🇦
The complete database of Morocco’s Office of Vocational Training and Employment Promotion (OFPPT), the country’s largest public technical training institution, has been detected being offered for… pic.twitter.com/mQ5Ho13l9o
— VECERT Analyzer (@VECERTRadar) April 12, 2026
The leaked data is described as highly sensitive. It reportedly includes full names, personal phone numbers, email addresses, enrollment details, academic tracks, and highly specific fields of study, including IT, mechanics, tourism, construction, and electricity. Diploma levels and detailed administrative records tied to more than 500 vocational training centers across the country are also said to be part of the dump.
Read also: Morocco’s AI School in Berkane Wins National Cybersecurity Competition
As of now, neither OFPPT nor Morocco’s Directorate General for Information Systems Security, DGSSI, has officially confirmed the breach, leaving the case in the category of unverified claims. Still, cybersecurity analysts have classified the potential risk as moderate to high if the leak is authenticated.
Technical sources cited by the monitoring platforms suggest the breach may stem from a vulnerability in OFPPT’s web applications, compromised employee credentials, or unauthorized access through third-party contractors.
If confirmed, the exposed records could be used for identity theft, impersonation of students or graduates, and highly targeted phishing campaigns built around real institutional data. That could make bank account theft, account takeovers, commercial espionage, and even blackmail more likely.
The case also sparked sharp reactions from Moroccan netizens, many of whom criticized the country’s rapid push toward digitalizing public services without matching investments in cybersecurity reinforcement. Several users said the incident reflects a wider structural problem, arguing that digital transformation has often moved faster than the systems designed to protect citizens’ personal data.
It also revives memories of the April 2025 CNSS cyberattack, when hackers leaked sensitive salary and personal data linked to nearly two million workers and around 500,000 companies, turning what many saw as a one-off breach into part of a broader and troubling pattern of attacks targeting Moroccan public institutions.
For now, attention is turning to whether Moroccan authorities issue an urgent official response and what immediate steps may be taken to protect those potentially affected.
Morocco World News is also on X — check out our latest posts now! Get MWN on iOS and Android for instant access to breaking news.
