Massive Leak Allegedly Reveals 70,000 Members of Moroccan Security Services and Links to an Espionage Network in Spain

 

The fallout in Spain continues from one of the largest alleged data breaches involving Morocco’s security and intelligence services, after the hacking group known as “Jabroot” published a database it claims contains 70,381 names of members of Moroccan security and intelligence agencies. At the same time, Spanish security services have reportedly begun examining and cross-checking the leaked data to identify individuals who are currently in, or have previously carried out activities in, Spanish territory.

The leak comes amid growing political and security tensions between Madrid and Rabat, and following the recent mass migration crisis involving the Spanish city of Ceuta, where, according to official Spanish figures, around 70,000 to 80,000 migrants entered over July 30 and 31.

The “Jabroot” group claims to possess information proving the involvement of officials within Morocco’s security and intelligence services in planning the operation.

According to Spanish media reports, the documents published by the group primarily contain data linked to the General Directorate for Territorial Surveillance (DGST) and the General Directorate of National Security (DGSN), two key components of Morocco’s domestic security and intelligence apparatus.

The group says the list contains identities, ranks and professional details of more than 70,000 people. Reports indicate that, according to the published files, the leak also contains personal information such as dates of birth, employee numbers, dates of joining the services, registration numbers and identification-card details.

Before releasing the full list, the group had published a sample of names of several members of Moroccan security agencies, accompanied by personal information, apparently in an attempt to demonstrate that it possessed a much larger database.

Spanish media have described the leak as one of the most serious breaches to have affected Morocco’s security apparatus, given its scale and the sensitivity of the data the hackers claim to have obtained. According to reports on the group’s activities, it has previously published data linked to employees of the royal palaces and information on around two million members of Morocco’s social-security system, as well as data concerning approximately 3,400 royal palace employees.

Five Members of the Moroccan Embassy in Madrid

Among the elements that have attracted particular attention from Spanish media are names linked to Morocco’s diplomatic mission in Madrid.

The Objective reported that it compared the names contained in the “Jabroot” file with the list of foreign diplomats accredited in Spain and identified five members of the Moroccan Embassy in Madrid among the leaked names. The individuals officially hold diplomatic positions.

According to the newspaper, the list includes Adel Alami, Khalid Lahsini, Tariq Sabil, Tami Belkaid and Prince Alami.

These details are particularly significant because some of the individuals reportedly hold senior positions within Morocco’s diplomatic structure in Madrid. The newspaper says Adel Alami officially ranks third at the embassy, while Khalid Lahsini ranks fifth. Tami Belkaid serves as an internal-affairs attaché and is an officer in the Moroccan security service who previously worked in Spain.

The newspaper stresses that the inclusion of these individuals in the “Jabroot” database does not in itself prove that they carried out intelligence activities in Spain, but rather provides a basis for the verification process reportedly initiated by Spanish security agencies.

11 Moroccan Vice Consuls Among the Leaked Names

The names linked to Spain were not limited to the Moroccan Embassy in Madrid. In an update published by the same newspaper on Thursday, it reported finding 11 Moroccan vice consuls in Spain among the leaked list, after comparing the names in the leak with official lists of Moroccan consular officials.

According to the same source, eight of them are based at four consulates—Algeciras, Barcelona, Las Palmas and Murcia—with two vice consuls at each. The remaining three names are distributed among the consulates in Almería, Bilbao and Seville.

The names cited by the newspaper are Qasim Raisouni and Younes Slimani in Algeciras; Mohamed Adel Arab and Mourad Rawi in Barcelona; Mohamed Ankri and Hamid Laslaa in Las Palmas; Mohamed El Khayam and Bouchaib Heddar in Murcia; in addition to Al Amrani in Almería, Mohamed Lakbir in Bilbao and Adel Tahri in Seville.

Some of these locations carry additional significance because of their geography. Algeciras, for example, is a major transit point between Spain and Morocco, while Moroccan consulates play extensive roles in dealing with the Moroccan diaspora and the movement of people between the two countries.

Spanish Security Services Begin Verification

In a notable development, Spanish media reported that Spain’s National Intelligence Centre (CNI) and the General Information Commissariat of the National Police had begun examining the list of 70,381 names by cross-checking it against databases held by Spanish authorities.

According to the newspaper, the objective is to determine how many of the individuals named in the leak are currently in Spain or have previously operated there, as well as to establish whether genuine links exist between them and Moroccan security and intelligence services.

Security sources, according to the same report, are treating the list cautiously, stressing the need to verify its contents and warning against automatically considering everyone named in it to be an intelligence operative. At the same time, they believe the documents could provide information of significant value to Spanish security agencies.

21 Names on the “Big Shots” List

Alongside the main database, the group published a separate file containing 21 names that it presented as senior officials at the top of Morocco’s security and intelligence hierarchy, under the heading “Big Shots.”

The list is reportedly headed by Abdellatif Hammouchi, Director General of National Security and Director General of Territorial Surveillance. It also includes senior officials in Morocco’s security, intelligence, counterintelligence and surveillance services.

“Jabroot” accuses several of these individuals of being behind the operation that allegedly facilitated the large-scale entry of migrants into Ceuta, particularly on July 30 and 31. However, media outlets reporting these allegations have emphasized that the accusations originate from the group itself and have not been independently verified.

One striking discrepancy noted by Spanish media is that the list includes the name of Abdallah Khayam, the former head of Morocco’s Central Bureau of Judicial Investigation, despite his death in 2022. This suggests that some files may contain errors or outdated information and underscores the need to treat the leak as material requiring independent verification.

Who Is Behind “Jabroot”?

The identity and true origin of the group remain unresolved. Spanish reports indicate that the group emerged in April 2025, when it was linked to a cyberattack and data leak involving Morocco’s National Social Security Fund, before expanding its operations to other institutions and sensitive datasets.

Moroccan authorities have accused the group of having links to Algeria, amid the well-known political tensions between the two countries. However, Spanish media reports indicate that this allegation has not been proven and that experts and intelligence sources question whether the group’s origin can be established on the basis of publicly available information.

La Razón has also cited sources and analyses suggesting that the possibility of a former Moroccan intelligence operative being behind the operations remains open, given the group’s apparent knowledge of the structure of Morocco’s security services and the nature of the data it has allegedly accessed.

Other analyses suggest that the activity attributed to the group does not resemble random hacking operations, given the nature of the targets and the scale of the leaked data. Other reports, however, stress that the identity of the individual or entities behind the group has not been independently confirmed.

Threat to Release Information Linked to Pegasus

The consequences of the leak may extend beyond the disclosure of names belonging to Moroccan security personnel. According to Spanish reports, the group has threatened to publish additional information related to Morocco’s alleged use of the Israeli Pegasus spyware, including what it claims is information concerning the mobile phone of Spanish Prime Minister Pedro Sánchez.

The issue has once again brought attention to Morocco’s alleged use of electronic surveillance software, a matter that previously triggered a political crisis in Spain following revelations that the phones of Spanish officials had allegedly been targeted with Israeli spyware by Morocco.

The new threats also come after international investigations published during July 2026 presented new information and evidence concerning Morocco’s alleged use of the software, while Rabat has continued to deny using the program despite previous investigations.

These developments are particularly significant for Spain given the level of security cooperation between Madrid and Rabat in recent years, particularly on counterterrorism, irregular migration and the fight against drug-trafficking networks.

At the same time, the disclosure of the names comes at a highly sensitive moment in bilateral relations, against the backdrop of the Ceuta crisis and the debate over responsibility for the mass influx of migrants, as well as the continuing repercussions of the Pegasus affair.

In 2025, Spanish Interior Minister Fernando Grande-Marlaska awarded Abdellatif Hammouchi a high Spanish decoration, a decision that Spanish media have brought back into focus following Hammouchi’s appearance at the top of the “Jabroot” list.

The information circulating so far highlights a striking paradox: while Madrid presents Rabat as a key security partner, the alleged leaks point to a broad network of individuals purportedly connected to Morocco’s security and intelligence services, including officials serving in diplomatic and consular capacities in Spain.

However, the most important aspect of the case remains the verification process reportedly undertaken by Spanish authorities. Cross-checking the names and data against official records could determine the authenticity of the files, the number of genuine identities involved, and whether actual intelligence links exist between the individuals named and Moroccan security agencies.

Pending the outcome of that verification, the list of 70,381 names remains a leak attributed to a hacking group, not a judicially established list of intelligence agents. If the identities are confirmed, however, the presence of Moroccan diplomatic and consular officials in Spain among the leaked files would represent one of the most sensitive aspects of the case for Spanish security and bilateral relations between Madrid and Rabat.