The cyberattack targeting the National Social Security Fund's (CNSS) database has raised serious concerns about the protection of personal data belonging to its affiliates. Speaking to Le360, Imad Elbaraka, president of the Deloitte Morocco Cyber Center, and Ali Moutaïb, an expert in economic intelligence, stressed the institution's obligation to remain vigilant, noting that the incident could expose it to «civil, administrative, or even criminal sanctions». The experts pointed out that in some countries, such attacks could lead to class action lawsuits, and highlighted that the breach also raises broader questions for the executive regarding governance. Imad Elbaraka noted that since 2022, cyberattacks on public institutions have increased significantly. In this context, «the CNSS incident is especially concerning because it involved data exfiltration and public dissemination». He emphasized that such incidents fall under Morocco's personal data protection laws (09.08 and 05.20). Similarly, Ali Moutaïb commended the efforts of the General Directorate of Information System Security (DGSSI) to «protect vital institutions and raise awareness among businesses», adding that companies must take the risks seriously. «In the absence of strong data protection measures involving all relevant public and private stakeholders, we could see even more serious scandals», Moutaïb warned. He called for «strict enforcement» against companies that fall behind in cybersecurity compliance. During a press briefing on Thursday following the Government Council meeting, Minister Delegate for Relations with Parliament and Government Spokesperson Mustapha Baitas described the cyberattacks as «criminal» and confirmed that «judicial authorities have been notified». He also stated that the relevant institutions had taken necessary steps to strengthen their digital infrastructure and implement all possible measures to enhance cybersecurity.
