“It is Algeria that hacked Morocco”: 70 000 names later, Le Monde says it was the kingdom's own former spies
Yasmine Belkacem — Genève, Suisse — 2026-09-15
Method note. This file rests on no anonymous source of ours: every element is published, dated and attributed. We systematically distinguish what is proven, what is confirmed by third parties, and what remains an allegation. And at the end, we concede what must be conceded.
🕵️ The facts, and their date
On 24 August 2026, a collective of hackers presenting itself under the name Jabaroot — which means “power” or “domination” in Arabic — published on Telegram a list of 70 000 names.
Who are these people? Members of the Moroccan security services: the General Directorate of National Security (DGSN) — the police — and the General Directorate of Territorial Surveillance (DGST) — domestic intelligence. They are presented as stationed in Europe and in the kingdom's strategic institutions.
What the lists contain: four spreadsheets with dates of birth, bank account numbers and the supposed professional ranks. A second list contains the names, ranks and bank data of 1 400 agents of the security or intelligence services.
And one name that says it all: that of Abdellatif Hammouchi, who heads at the same time the Moroccan police and domestic intelligence — the King's “super cop”. His name appears among the 70 000, and so do his personal data.
🇪🇸 What the group claims, and why it matters
Jabaroot accompanied its leak with a message. The group presents these lists as “a gift to Spain” — and accuses Moroccan security officials of having facilitated the passage of thousands of migrants towards the enclave of Ceuta in late July 2026.
The figure that gives the measure: around 72 000 people crossed the border towards Ceuta during that crisis.
In other words: the group is not merely saying “we stole files”. It is saying: this is what your police organised. That is a far heavier accusation than a simple data leak.
🇩🇿 The accusation that circulated — and that must be faced squarely
For months, the name of Jabaroot was associated with Algeria by the Moroccan media. Headlines spoke of “pro-Algerian hackers”.
This is a serious accusation, and that is exactly why it must be verified — not repeated, not denied: verified.
And this is where the case turns around.
📰 What Le Monde wrote — on 26 August 2026
**The French daily Le Monde published on 26 August 2026 an investigation into this cyberattack. Its conclusion calls into question the link between the group and Algeria: according to the newspaper, the attack is the work of former agents of Moroccan domestic intelligence**.
Le Monde describes the attack as “unprecedented”, and emphasises that it particularly targets Abdellatif Hammouchi himself.
And the newspaper notes what it calls “the detail that says everything about the sensitive nature of the leak”: it is not only the names that leaked — it is the personal data of the head of the services, including his bank details.
Measure what that means. One does not hack the bank accounts of the head of intelligence by chance. This is not an opportunistic theft: it is someone who knew where to look.
🇪🇸 And what former agents confirmed to El Confidencial
**The Spanish outlet El Confidencial, for its part, gathered decisive testimony: several former agents of the Moroccan intelligence services confirmed that some of the leaked names did indeed belong to the DGST**.
The list was therefore judged authentic — “at least partially” — by the very people who served in those services.
**And El Confidencial goes further: it speaks of “the most important security breach the kingdom's security services have ever faced**”.
Remember that sentence. It comes neither from Algiers, nor from Moscow, nor from an anonymous account: it comes from a Spanish newspaper, a third country, about an ally of Spain.
⚖️ The official Moroccan version — and its problem
Morocco has denied the attack. Its version: the data would not come from an intrusion, but from old information obtained from databases operated by insurance companies.
This is an understandable defence — and it has one merit: it does not deny that the names exist.
But it runs into two obstacles.
First obstacle: authenticity. If the data came from old insurance files, how do you explain that former intelligence agents recognise their colleagues and their DGST membership?
Second obstacle: origin. If the data came from insurance files, **how do you explain that Le Monde attributes the attack to former spies of the kingdom?**
An insurance record does not give you an agent's rank, nor the directorate he belongs to, nor his account number.
🎯 What this affair demonstrates, and what goes beyond Morocco
First, a technical fact, and it is brutal: 70 000 names are out. For an intelligence service, this is the worst possible scenario — not because the names are precious in themselves, but because they make it possible to identify, locate and turn agents posted abroad.
Then a political fact: the first reaction was not to look for the breach. It was to look for a culprit outside.
It is a reflex we all know. When something breaks on the inside, it is more comfortable to accuse the neighbour than to look at one's own locks.
And there is a question that nobody in Rabat has asked publicly: if 70 000 names could get out, who was watching the door?
⚖️ What we concede, because it is true
We do not know the real identity of Jabaroot. The group has not proved its links, and no one has claimed the attack in the name of a state. We therefore do not assert that Algeria is innocent because it would be our country: we say that no public evidence accuses it.
The authenticity of the list is not total. The sources speak of an authenticity that is “at least partial”. That means that false or outdated names are probably included.
**And we will not claim that Le Monde holds the definitive truth. A newspaper reports what its sources give it. But it is a newspaper that is named, dated, verifiable — and it says the opposite of what the Moroccan press repeated.**
🎯 The conclusion, in three sentences
On 24 August 2026, 70 000 names of Moroccan agents — including that of the head of intelligence — were published, with their bank data.
**The accusation against Algeria circulated for months. Le Monde and El Confidencial wrote the opposite: a breach from within.**
And the real question is not who to accuse: it is how 70 000 doors could open at the same time.
🔗 The sources, in direct access — click and verify for yourself
- **The 24 August leak, its content, the attribution to former Moroccan spies by Le Monde, and the detail of Mr Hammouchi's personal data** — TSA Algérie, 27 August 2026: https://www.tsa-algerie.com/jabaroot-la-piste-algerienne-sefface-dex-espions-marocains-derriere-la-fuite-de-70-000-noms-dagents/
- The detailed description of the leak, the second list of 1 400 agents, the Moroccan denial and the 72 000 people who crossed towards Ceuta — Middle East Eye, 11 September 2026: https://www.middleeasteye.net/news/jabaroot-behind-hacker-group-claim-70000%E2%80%91name-leak-Morocco-police-intelligence
- The lists presented as “a gift to Spain”, the authenticity confirmed by former Moroccan agents and the phrase “most important security breach” — Courrier International, citing El Confidencial: https://www.courrierinternational.com/article/cyberattaque-des-hackeurs-proalgeriens-publient-les-donnees-de-70-000-agents-marocains-presumes_263951
These three links open the cited articles directly, with their dates. They are enough to verify the entirety of this file, element by element.
Final note. We have neither contacted, nor received, nor published the data in question — and we will not publish it: these are the personal data of tens of thousands of people, including bank details. Our job is to document the breach, not to extend it. Where a piece of information is only an accusation, we write “accused”, and we name the one who accuses.