The OFPPT “My Way” leak: 100,000 young people’s profiles exposed, and what it teaches

In April 2026, data on about 100,000 young people registered on OFPPT’s “My Way” guidance platform was published. The likely cause: a legitimate account that had been hacked. Lessons for any online platform.

On 12 April 2026, Morocco’s vocational training office, the OFPPT, identified a data leak affecting its “My Way” guidance platform. A file containing information on about 100,000 people was published on the dark web.

The data involved

• First and last names, phone numbers, email addresses and national ID numbers.
• About 70% of those affected were prospects and 30% potential trainees, registered to get information or take an interest test.
• According to the OFPPT, no supporting documents leaked, and the rest of the system (training records, transcripts) was not affected.

A common cause: a legitimate account taken over

Early analysis pointed to the fraudulent use of a legitimate account that had been compromised beforehand, rather than a direct break-in to the infrastructure. It is a common scenario: a stolen or reused password is enough to reach data, without any spectacular technical flaw.

What any platform can do

• Require two-factor authentication for accounts that can see many users’ data.
• Limit permissions: each account sees only what it needs.
• Monitor bulk exports and alert when an account downloads far more than usual.
• Collect only the data you truly need: data you never collected cannot leak.

For the people affected

The main risk is phishing: messages that use your name or number to look credible. Be careful with unexpected links and payment requests, and change any password you reuse elsewhere.

The best-protected data is the data you never collected.

Sources: OFPPT statement reported by TelQuel, H24info, Le Desk and FNH, April 2026.

Launching a platform or a customer area? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.