Despite repeated warnings and significant investments in cybersecurity, CNSS's information systems have once again proven to be faulty. Let's take a closer look at a breach that raises as many questions as it does concerns. A dark Tuesday for cybersecurity in Morocco. Just hours after the attack on the Ministry of Employment, the hacker group JabaRoot DZ claimed responsibility for a major breach of the National Social Security Fund (CNSS) systems. Hackers gained access to sensitive data, including salary certificates, company declarations, and the nominal list of employees. As a result, 53,576 PDF files containing information on 500,000 companies and 2 million employees were compromised. CNSS had long been aware of the extreme sensitivity of the data it held and had been warned about the vulnerability of its information systems. Back in January 2020, Yabiladi exposed unsecured access to the data of 3.5 million private-sector policyholders on the CNSS website, including ID numbers, postal addresses, bank account details, and four years' worth of health reimbursement histories and pay slips. At that time, the CNSS IT team fixed the issue without consequences for policyholders, thanks to a whistleblower and the media's role in bringing attention to the problem. One would have expected that experience to serve as a lesson. CNSS increased its cybersecurity budget in response, and in 2024, it launched at least two cybersecurity tenders worth a total of 4.8 million dirhams. Two tenders for a massive data leak According to our sources, the first tender (12/2024) was awarded to Dataprotect, a Moroccan cybersecurity firm founded in 2008 with a presence in several African, European, and Middle Eastern countries. This tender, worth 2.75 million dirhams, involved an audit of the CNSS's security practices. Dataprotect was the sole bidder. The second tender (96/2024), worth 1.6 million dirhams, was awarded to Modcod, a cybersecurity company established in 2018 and based in Rabat. This contract focused on an intrusion prevention solution, along with an annual maintenance contract valued at 480,000 dirhams. JabaRoot behind the attack, but who is accountable ? It's concerning to see so few bidders for tenders that are both strategically crucial for national security and financially significant. Moroccans will understandably question the integrity of the selection process, particularly given the recurring breaches and the severity of Tuesday's data leak. Ultimately, responsibility lies with the leaders of CNSS. While no system can be entirely risk-free, the multiple warnings and the financial and technical resources at their disposal should have been sufficient to prevent such a massive data breach. This is not just a matter of national security, data protection, and trust in our institutions. The leak will also affect personal and professional relationships, with private salary information now exposed to the public eye.
