Jabaroot: Behind the hacker group's claim of a 70,000‑name leak in Morocco's police and intelligence

On 24 August, the hacker collective Jabaroot announced they had released 70,000 names belonging to Morocco's police and intelligence network stationed in Europe and within Moroccan institutions. The list, compiled in four spreadsheets, contained personal information such as birth dates, bank account numbers, and supposed professional rankings for individuals associated with Morocco's General Directorate of National Security (DGSN), national police, and General Directorate of Territorial Surveillance (DGST).

Morocco denied the attack, stating the data came from old information obtained from insurance company databases. Jabaroot published the leak on Telegram, calling it a "gift to Spain" following the migrant crisis, which saw 72,000 people cross into the Spanish enclave of Ceuta from Morocco.

While some suspect Jabaroot to be an Algerian group, it is possible that five former DGST agents living in exile in Europe could be responsible. Dr Bassant Hassib, assistant professor of political science at the University of London Programmes, notes that the leak should be treated with caution due to outdated information and the potential for non-intelligence/security personnel to be included on the list.

An anonymous former Moroccan overseas intelligence officer confirmed some of the names on the list are accurate, revealing at least one entire informant family was correctly identified. The former intelligence agent warns that the leak will cause chaos within the system, as all those named are now compromised and will need to return to Morocco.

With hundreds or thousands of contacts "burned," the former intelligence agent states that previously deployed staff will likely be called back overseas to replace those implicated in the leak. Even if the data is only partially correct, the leak endangers the agents, as name and bank details can lead to targeting or harassment.

Jabaroot can benefit from publishing outdated or incorrect data, as the collective can claim a new breach while reusing older information, potentially inflating their standing and future attack capabilities.