Agadir – Morocco recorded nearly 7,300 cyber threat events in 2025, placing it third among African countries most affected by cyber incidents, according to a Mastercard report.
The report found that Morocco accounted for 10.6% of the 69,236 cyber threat events recorded across Africa last year.
Nigeria ranked first, representing 24.4% of the continental total, followed by South Africa with 12.6%.
Egypt is fourth in terms of cyber threats with 8.8%, while Kenya accounted for 7.1%.
Mastercard’s Cyber Insights platform recorded an average of 612 events per month in Morocco, with a peak of 1,882 in April 2025.
Cyberattacks target sensitive Moroccan data
Several incidents involving Moroccan public institutions illustrated the risks to organizations that manage sensitive personal and financial information.
The National Social Security Fund (CNSS) confirmed on April 8, 2025, that a cyberattack had targeted its information systems. According to the report, the incident exposed personal data linked to nearly two million people and approximately 500,000 affiliated companies.
On June 2, 2025, another cyberattack targeted the National Agency for Land Conservation, Cadastre and Mapping (ANCFCC). A group identifying itself as Jabaroot claimed responsibility and said it had extracted four terabytes of data, including property records and documents containing identity, passport, and banking information.
These incidents highlight the risks facing institutions that store large volumes of personal data. Unauthorized access to such information can expose individuals and businesses to fraud, identity theft, and other forms of misuse.
The threat also extends beyond government institutions. Mastercard found that technology, public administration, and financial services together accounted for 44% of the cyber threat events recorded across Africa in 2025.
Cybercriminals adopt increasingly sophisticated methods
The report identified malware, ransomware, email-based social engineering, and reconnaissance operations among the main methods used in cyberattacks across the continent. Together, these techniques accounted for 57.6% of observed incidents.
Malware allows attackers to infiltrate systems, steal information, or disrupt operations. Ransomware can block access to files and demand payment, while social engineering uses deceptive messages to trick victims into revealing credentials or opening malicious attachments.
Attackers also conduct reconnaissance to identify system weaknesses and exposed infrastructure before attempting to gain access.
The report also points to the growing organization of cybercrime. Among incidents with an identified perpetrator, malicious hackers accounted for 41.5%, while organized criminal groups represented 20%.
Politically motivated actors accounted for 13.9% of attributed incidents, while state-sponsored or state-supported actors represented 9.7%. These groups may pursue different objectives, including financial gain, espionage, or disruption of critical systems.
Morocco legal and cooperative cybersecurity framework
Morocco has developed a legal and institutional framework to protect information systems and personal data.
The General Directorate for Information Systems Security (DGSSI), established in 2011, serves as the country’s national cybersecurity authority and oversees the Moroccan Computer Emergency Response Team, known as maCERT.
Law 09-08, adopted in 2009, regulates the processing of personal data and provides for oversight by the National Commission for the Control of Personal Data Protection (CNDP).
Morocco has also called for stronger regional cooperation to address the growing cybersecurity threats. During a high-level cyber diplomacy meeting held in Rabat from October 12 to 14 as part of Morocco Cyber Security Week, the Moroccan Agency for International Cooperation (AMCI) stressed the importance of African collaboration on cybersecurity and digital sovereignty.
The agency is working with DGSSI to share Moroccan expertise, develop training programs, and strengthen cybersecurity capabilities across African countries.
Cybersecurity has also received renewed attention following the discovery of critical vulnerabilities in PHP, a programming language widely used to power websites and web applications. On Wednesday, government agencies and other organizations worldwide temporarily took websites and online services offline to address the flaws and apply security updates.
