The CNSS breach: what happened, and what Moroccan businesses should take from it

In April 2025, data on nearly 2 million employees registered with Morocco’s social security fund was published online. A look back at one of the largest leaks in the country’s history, and the habits it should change.

In early April 2025, a file presented as coming from Morocco’s Caisse nationale de sécurité sociale (CNSS) was shared on Telegram. The story quickly became national news: according to the CNSS, the leak involved data on about 2 million employees, linked to nearly 500,000 companies.

What is known

• A group presenting itself as Algerian, “JabaRoot DZ”, claimed the attack and the release of the data.
• According to press reports, the files included names, national ID numbers, email addresses and bank details.
• The CNSS announced an internal administrative investigation and referred the matter to the judicial authorities.
• How the attackers got in has not been publicly confirmed; several theories circulated without official validation.

Why this also concerns businesses

The published data does not only describe employees: it also describes employers. It can fuel targeted scams, such as a fake email or call in the name of the CNSS, a bank or a supplier that quotes accurate details to look credible.

The right reflexes after a leak like this

• Brief your team: be wary of any message asking for a payment, a password or new bank details, even if it seems well informed.
• Confirm any change of bank details by calling a number you already know, never the one in the message.
• Turn on two-factor authentication for work email and business bank accounts.
• Change passwords that are reused across several services.

What the incident shows

An organisation can lose data it did not think was exposed, and the consequences then reach thousands of others. For a business, the question is not only “am I a target?” but “what happens if my data, or my customers’ data, is circulating?”

A data leak does not end the day it is discovered: that is often when the scams begin.

Sources: CNSS statements and Moroccan press (TelQuel, Le Matin, Hespress), April 2025.

Want a website and forms that better protect your customers’ data? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.