Morocco's Social Security Fund Was Breached — And Victims Still Haven't Been Told

Morocco's most consequential recent privacy failure involves the National Social Security Fund, or CNSS. A threat actor operating under the alias "Jabaroot" leaked a dataset verified by cybersecurity researchers to contain the personal data of over 1.99 million individuals, including salary details and personally identifiable information tied to both employees and employers. What makes this case especially significant: no official notification has been issued by CNSS or Moroccan regulators, and victims reportedly remain uninformed despite growing risks of identity theft, fraud, and social engineering.

The Leak May Have Sat Hidden for Months Before Release

The timeline behind the CNSS breach raises its own concerns about transparency. The leaked files carried timestamps from November 29, 2024, suggesting the breach may have occurred months before the data was actually released — with cybersecurity professionals speculating that the actor may have deliberately withheld the data to benefit from exclusive access before eventually leaking it publicly. Unlike most cybercriminals seeking profit through ransomware or dark market sales, Jabaroot made no attempt to monetize the breach, with some analysts suggesting the incident may have been tied to regional political tensions rather than ordinary financial crime.

Morocco Faced Over 20 Million Cyberattack Attempts in Just Six Months

The CNSS breach isn't an isolated incident — it's part of a much larger pattern of sustained attacks. In just the first half of 2025, Morocco faced over 20.7 million cyber-attack attempts, according to Kaspersky telemetry data, with credential-stealing malware usage up 22% during that period. Separately, more than 6.4 million phishing emails targeting Moroccan companies were blocked in 2024 alone — millions of individual attempts to trick people into surrendering their credentials or sensitive information.

A Legal Gap Leaves the Regulator Unable to Fine Companies Directly

Morocco's data protection framework has real limits in how it can respond to failures like the CNSS breach. Under Moroccan law, it is the responsibility of the courts, not the CNDP — Morocco's data protection authority — to impose fines for breaches of certain legal provisions, meaning the regulator's own enforcement power is more constrained than in jurisdictions where the authority can fine companies directly. This structural gap may help explain why, months after the CNSS breach became public, affected individuals still hadn't received formal notification.

What Moroccan Users Should Do Right Now

Given that CNSS data — including salary and personal details for roughly 2 million people — has already circulated publicly without official notification, assume your information may be included and act accordingly: monitor your bank and government accounts for unfamiliar activity, and be skeptical of any unsolicited communication referencing your salary or employment details. A VPN encrypts your internet traffic and masks your real IP address, adding a layer of protection against the kind of phishing and credential-harvesting attempts that have surged dramatically in Morocco over the past two years. Choose a VPN with a verified no-logs policy and strong AES-256 encryption, and enable two-factor authentication on your banking, government, and employment-related accounts as a baseline defense against the credential theft that Morocco's own security data shows is actively rising.

VPNs Are Legal for Personal Use

VPN use is legal for personal use in Morocco. Morocco has made news for restricting VoIP services like Skype, Viber, WhatsApp calls, and Facebook Messenger, but the country has never outlawed VPN use itself. The standard rule applies: what's illegal without a VPN stays illegal with one — but simply having and using a VPN carries no legal risk.

What to Look For in a UCN VPN for Morocco

VoIP access has been the defining issue in Morocco for years, though reports on its current status are mixed — some recent coverage indicates VoIP restrictions have eased, while other guidance from mid-2026 still describes WhatsApp calls, Skype, and FaceTime as blocked at the ISP level. Given that uncertainty, choose a UCN VPN with WireGuard® encryption and reliable server performance so you're covered either way — a working VPN restores VoIP calling regardless of which restrictions happen to be active when you connect.

Why People in Morocco Actually Use a VPN

Morocco's National Telecommunications Regulatory Agency (ANRT) has historically managed VoIP blocking to protect state telecom revenue, a pattern common across North Africa. Political opposition and critical news sites are occasionally blocked as well. Most travelers and residents use a VPN for far more everyday reasons, though — protecting data on public Wi-Fi in Marrakech, Fes, or Casablanca, and accessing home streaming libraries like Netflix or BBC iPlayer that are otherwise geo-locked. Morocco is also popular with digital nomads, who rely on a reliable UCN VPN daily for both connectivity and privacy.

What "No-Logs" Actually Means

A no-logs policy means the VPN provider stores no record of your browsing activity, IP address, or connection times — so there's nothing to hand over if it's ever requested. Morocco's cybercrime law and antiterrorism provisions have at times been used to prosecute online speech, making an independently audited no-logs policy a meaningful layer of protection for anyone active in political discussion, journalism, or general privacy-conscious browsing.

Getting Started in Under a Minute

Download the UCN VPN app, sign in, and tap Connect — your traffic is encrypted immediately. Keep the VPN running whenever you switch between mobile data and hotel or café Wi-Fi, and connect to a server in your home country to unlock your own streaming library while traveling.

Morocco's internet is generally open with a few specific chokepoints — a UCN VPN clears VoIP calling and streaming access in one simple step, whatever the current restrictions happen to be.