NARSA (Morocco): National Road Safety Agency database leak
NARSA (National Road Safety Agency)
Overview
On 8 November 2025, an actor operating as PKA291 announced on DarkForums.ru that the National Road Safety Agency (NARSA) of Morocco had been compromised. The poster claims full access to the agency management system and released a limited sample as proof, stating that the entire database is in the hands of the group.
Claims made by the actor
The post says the intrusion was a takeover of the management system rather than a partial breach. The exposed material reportedly covers about 150,000 rows and includes:
- Inspection records of 50cc motorcycles registered in Morocco
- Full names, national ID numbers (CIN) and license plate numbers
- Residential addresses extracted from internal logs
- Documents that the actor presents as proof of bribery and fraud
The demand is not financial. The message calls on the agency to stop fraud and bribery and to redirect resources toward hospitals, schools and youth programs.
Independent coverage
The Record reported that Moroccan authorities opened an investigation into a breach allegedly carried out by hackers linked to Algeria. Cyhawk-Africa also covered the incident, which supports the forum claims.
What remains unknown
The total volume of records actually exfiltrated has not been verified outside the actor statements. Whether the whole database was taken, and how access was obtained, remain open questions. The bribery documents have not been independently reviewed.
Advice for affected people
Moroccans whose national ID or vehicle registration data may be involved should watch for phishing attempts that use those details. Anyone contacted with demands based on this data should report it to the authorities.