Moroccan government portals (.gov.ma): claimed data breach on DarkForums

Overview

On 15 May 2026, a DarkForums user named fexus published a post titled ".gov.ma BREACH" claiming to hold extracts from multiple Moroccan government portals. The post lists line counts for nine official services, including the education platforms moutamadris.men.gov.ma and massar.men.gov.ma, tax services and other public systems, and provides a download link with a password. Independent coverage by Undercodenews describes a cyberattack panic in Morocco linked to dark web postings of government data.

What was published

The claimed extracts include:

• moutamadris.men.gov.ma with 16,813 lines
• massar.men.gov.ma with 14,090 lines
• waliye.men.gov.ma with 8,146 lines
• rn.ae.gov.ma with 7,948 lines
• attestation.tax.gov.ma with 7,880 lines
• simpl-tva.tax.gov.ma, tva.tax.gov.ma, cpu.tax.gov.ma and candidaturebac.men.gov.ma with several thousand lines each

The poster says further releases are planned.

Risks for affected individuals

School and exam portals such as Massar and Moutamadris hold student records, grades and family information. Tax service extracts can contain identifiers and financial data. Exposure of such data can enable identity fraud and targeted phishing against students, parents and taxpayers.

What remains unknown

The nature of the columns in each extract is not documented, and the authenticity of the download is not independently verified. The Moroccan government has not issued a public confirmation. The total number of unique individuals is unknown.

What affected people should do

Users of Moroccan e-government services should change passwords on official portals, enable two-factor authentication where available, and treat messages that cite their student or tax records with caution. Suspected exposure should be reported to the relevant ministry.