Morocco ANCFCC land registry data leak
Weeks after the CNSS breach, the hacktivist Jabaroot leaked roughly 4 terabytes of data — millions of property certificates, title deeds, ID cards, passports, and banking documents — from Morocco's national land conservation agency ANCFCC.
- Victim
- Agence Nationale de la Conservation Foncière, du Cadastre et de la Cartographie (ANCFCC)
- records
- 4.0M
On 2 June 2025, the hacktivist Jabaroot — already responsible for the April leak of Morocco's social-security fund — claimed a second major breach against the Moroccan state: the Agence Nationale de la Conservation Foncière, du Cadastre et de la Cartographie (ANCFCC), the national agency that maintains the kingdom's land titles, cadastre, and mapping records.
What happened
Posting on a dark-web forum, Jabaroot claimed access to over 10 million property certificates and more than 4 million documents totalling in excess of 4 terabytes of data. Samples published to substantiate the claim included title deeds, deeds of sale and purchase, civil-status documents, copies of national ID cards, passports, and banking documents, along with what the actor described as sensitive "VIP" records.
Because ANCFCC's registry underpins property ownership, mortgages, and inheritance across Morocco, the exposed documents carried acute risk for real-estate fraud, forged conveyancing, and identity theft. Researchers at CybelAngel verified the authenticity of sampled documents, though some forum participants questioned whether the entire trove originated directly from ANCFCC systems or aggregated data from multiple sources. Moderators ultimately removed the thread after download links broke.
Attribution and motive
As with the CNSS leak, Jabaroot framed the ANCFCC attack as retaliation against perceived "anti-Algerian propaganda" by Moroccan media, situating it within the broader Algeria–Morocco geopolitical confrontation and the Western Sahara dispute. The actor — variously described as "Jabaroot DZ" and as Algeria-linked — again did not seek ransom, reinforcing the assessment that the campaign was hacktivist and politically driven rather than financially motivated.
Impact
The ANCFCC leak marked an escalation in a sustained campaign. In the 10 weeks following the CNSS breach, CybelAngel observed a 312% increase in leaked data attributed to Moroccan entities, with more than 5 terabytes of stolen material published across clear- and dark-web platforms between April and mid-June 2025. The back-to-back compromise of two pillars of the Moroccan state — social security and land ownership — exposed systemic weaknesses in the cybersecurity of the country's most sensitive public registries.
Why it matters
Land-registry data is among the most consequential a government holds: it establishes who owns what. The ANCFCC breach demonstrated that geopolitically motivated hacktivism could reach beyond personal identity data into the legal foundations of property itself, and that Morocco's public institutions faced a coordinated, multi-target adversary capable of repeatedly exfiltrating data at terabyte scale. It cemented 2025 as a watershed year for Moroccan public-sector cyber risk.
Timeline
Jabaroot's campaign against Morocco opens with the leak of CNSS social-security data.
Jabaroot claims responsibility on a dark-web forum for a breach of ANCFCC, Morocco's national land conservation agency, posting samples of property certificates.
The actor claims access to over 10 million property certificates and more than 4 million documents totalling over 4 terabytes, including VIP records.
Researchers at CybelAngel and others verify the samples; forum users question whether the full dataset originated directly from ANCFCC.
CybelAngel reports a 312% surge in leaked Moroccan data over the 10 weeks since the CNSS breach, exceeding 5 terabytes published across the clear and dark web.
Sources
- cybelangel.comhttps://cybelangel.com/blog/ancfcc-data-leak-flash-report/
- cybelangel.comhttps://cybelangel.com/blog/a-cnss-breach-update/
- biometricupdate.comhttps://www.biometricupdate.com/202504/sensitive-pii-of-millions-leaked-in-historic-moroccan-data-breach
- resecurity.comhttps://www.resecurity.com/blog/article/cybercriminals-attacked-national-social-security-fund-of-morocco-millions-of-digital-identities-at-risk-of-data-breach