Sometimes the problem is not simply that confidential data has escaped from its source, but what happens to that data once it is out.
In cybersecurity, an old database can come back to life under a new headline. An administrative employee can become an “espionage agent” in a newspaper headline. And a huge number can give a story a force that the evidence itself does not necessarily support.
That is more or less what happened with the files published on August 24 by the hacking group calling itself “Jabaroot.” The group claimed to have exposed the identities of around 70,000 people working for Morocco’s security and intelligence services. The number spread quickly. Then came the label: “70,000 Moroccan spies.” Only afterwards did the details begin to emerge.
The real issue, therefore, is not simply whether Jabaroot published authentic files or whether the entire material is fabricated. The evidence currently available allows neither conclusion to be established. The more precise questions are different: What do these files actually contain? Where did they come from? How old are they? And why were they presented as a list of intelligence agents?
Those questions change the nature of the story.
The French daily Le Monde, which says it examined the four tables, approached the material with considerably greater caution. Rather than treating them as a current register of Morocco’s intelligence services, the newspaper said the nature of the information suggested a database connected to a payroll or personnel-management system. It also noted that the most recent hiring date visible in the data was from 2020. Most importantly, Le Monde said it was not possible at this stage to establish the authenticity of the published lists as a whole.
That detail is not a technical footnote.
If the database is old, it does not necessarily show who is currently working inside these institutions. And if it is a personnel database, its existence does not automatically mean that everyone listed in it is an intelligence operative.
Some of the names make the problem even clearer.
Abdelhak Khiam, the former head of Morocco’s Central Bureau of Judicial Investigation, appears in the circulated data even though he died on August 23, 2022. His death was widely reported at the time and is not disputed.
The presence of a man who has been dead for four years does not, by itself, prove that the entire database is fake. But it does establish something much more important: if the data are authentic, even in part, they are not necessarily a current snapshot of Morocco’s security services in 2026.
There is a second problem, and it is more significant still.
The files appear to mix personnel associated with Morocco’s General Directorate of National Security, or DGSN, with others linked to the General Directorate for Territorial Surveillance, or DGST. The sample examined also contains people identifiable as administrative employees, along with names that are difficult to match to real individuals or that contain apparent errors and unusual combinations.
In other words, the word “spies” appears to have come from the source of the leak and was then transformed, in parts of the media coverage, into an established fact.
That is precisely where journalism has to begin.
The Objective, for example, cited a figure of 70,381 people and said it had found among the names employees of the Moroccan embassy in Madrid. The publication went further, raising the possibility that diplomatic positions could serve as cover for intelligence activities.
But the appearance of a diplomat’s name in a database attributed to security services is not, by itself, evidence of clandestine intelligence work. And when the names in the leaked material differ from those appearing in official records, that discrepancy should lead to more verification, not greater certainty.
It would nevertheless be equally careless to reverse the story completely and conclude that there is “nothing” behind the leak.
Personal data attributed to people connected to Moroccan security institutions have in fact been published. Large files have been released. And Jabaroot has a documented history of releasing sensitive Moroccan data.
In April 2025, the group was associated with the hacking of data linked to Morocco’s National Social Security Fund, followed by the publication of information concerning millions of Moroccans. Further releases subsequently involved information relating to employees of public institutions and various government bodies.
That history gives greater weight to the possibility that at least some of the current material comes from genuine access to Moroccan databases. It does not, however, establish that the 70,000 people named are intelligence agents.
A different hypothesis therefore appears more plausible than the story of “70,000 spies.”
Part of the data may be authentic while having been reassembled from older databases or information obtained during previous breaches, and then placed inside a new security narrative.
This is not an unusual mechanism in large-scale data leaks. Information gathered from different sources can be combined, cleaned, renamed and presented as a new discovery.
That possibility explains several anomalies that the “70,000 spies” narrative struggles to explain: administrative employees appearing in the lists, old dates, the inclusion of a deceased person, the mixing of different institutions and inconsistencies in some of the names.
But there is another dimension of the story that cannot simply be ignored.
The leak came after the Ceuta crisis, at a particularly tense political and media moment between Morocco and Spain. Jabaroot itself sought to connect the published data to the events of July 30 and 31, claiming to possess information about Moroccan officials who had allegedly participated in “organizing” the operation.
Several Spanish media outlets adopted that interpretation and linked the leak to allegations of Moroccan involvement in the migration crisis.
This is where timing becomes part of the story.
The Ceuta crisis itself has not yet produced a single, definitively established account. Moroccan and Spanish narratives differ over its origins, its degree of organization and the possible role of different actors. Some analyses have suggested that what happened may have resulted from a succession of reactions and security failures rather than from a fully planned operation directed from Rabat.
In that context, inserting the “70,000 spies” list into the Ceuta story inevitably produces a political and media effect, even before the technical origin of the files has been conclusively established.
Yet the Spanish media themselves have not adopted a uniform position.
La Razón, which initially presented the case as the exposure of “70,000 Moroccan agents,” later published doubts from intelligence and cybersecurity experts concerning both the figure and the nature of the data. The newspaper stressed that an investigation would have to determine what the files actually contain.
Other outlets, however, continue to treat the number and the description of those listed as “agents” or “spies” as though they were already established facts.
That difference in treatment matters.
It shows how an assertion made by an anonymous group on Telegram can become a newspaper headline, and then return to the digital information ecosystem as if it had been independently confirmed by several media organizations.
Le Monde has also added another layer to the case, reporting that its information points to five former DGST members living in Europe as being behind the operation.
If that hypothesis were eventually confirmed through technical and judicial investigation, the nature of the case would change dramatically. The question would no longer be only about a stolen database, but about how the information was extracted, who had access to it and why it was allegedly used.
For now, however, this remains information attributed by Le Monde to its sources. It should not be turned into an established judicial fact before an independent investigation confirms it.
This is why the most spectacular headline in the case may also be the least accurate.
Nothing in the evidence currently available allows us to say that Morocco has lost a “list of 70,000 spies.” But neither does the evidence allow us to conclude that the entire affair is fabricated.
It is precisely in the space between those two certainties that the real story lies.
There are data that appear genuine, others that still require authentication, a database that appears to be partly old, administrative employees, the name of a person who died years ago, several institutions brought together in a single file, and a political environment in which every piece of information can be exploited almost instantly.
That is what makes the leak more consequential than an inflated number.
The battle is no longer only about the confidentiality of the data. It is also about who has the power to define that data and give it meaning once it has escaped its original source.
Jabaroot claims to have exposed 70,000 spies.
Some media outlets speak of 70,000 agents.
What can be said today, with greater journalistic rigor, is less spectacular but considerably more solid: there is a leak that warrants investigation, there is data that requires verification, and there are enough anomalies to undermine, for now, the ready-made narrative that turns every name in a personnel database into an “espionage agent.”
In an information war, the danger may therefore not be that a piece of data is entirely true or entirely false.
It may be that it is true enough to allow someone to build a story far larger than the data itself.
