Cyber Risk Across the Maghreb

The Maghreb has entered a phase where cyber risk is no longer a technical footnote to political stability, but part of the political story itself. Attacks now carry state signatures, target civilian infrastructure, and travel across the region's oldest fault lines. For governments, corporations, and civil society, the question has shifted from whether to invest in cyber resilience to how quickly they can catch up with adversaries who are already inside the system.

The CNSS breach: a case study in political cyber

In April 2025, Morocco's National Social Strategic Affairs Fund (CNSS) suffered one of the largest data breaches ever recorded in North Africa. More than 54,000 files were exfiltrated, exposing information on nearly 2 million people names, national ID numbers, company affiliations, email addresses, phone numbers, and bank account details (The Record). Some documents dated back to November 2024 and were posted on a public Telegram channel.

The hacker group JabaROOT claimed responsibility and framed the breach explicitly as retaliation, accusing Morocco of targeting Algerian institutions online. Cybersecurity research firm Resecurity noted that the stolen data was uploaded to dark web forums but not offered for sale, suggesting a political rather than financial motive. CybelAngel indicated the intrusion may have exploited a zero day vulnerability in Oracle based systems (The Record).

This is the wider context: Algeria severed diplomatic ties with Morocco in August 2021, closed its airspace, halted gas pipeline flows, and imposed visa requirements on Moroccan nationals. Five years later, the rupture has extended into cyberspace, and civilian databases are collateral.

What the CNSS breach revealed

Three lessons from the breach deserve attention across the region.

Public institutions hold catastrophic aggregations of personal data with underinvested defences. A social protection fund is, by design, one of the most sensitive databases in any country. It maps citizens to employers, to bank accounts, to family relations. When such a database is compromised, the downstream harm targeted fraud, social engineering campaigns, coercion can persist for years. Few Maghreb institutions have modeled worst case scenarios at this scale.

Third party and supply chain risk is the frontline. Oracle based systems are used across the region's public administration. If a single vulnerability in a widely deployed platform can compromise a national database, then patch management discipline is a strategic issue, not an IT one.

Attribution is political. In the CNSS case, no forensic report has publicly confirmed state sponsorship, yet the narrative was immediately geopolitical. This is the reality operators must plan for: cyber incidents in the Maghreb will be interpreted through the lens of regional rivalry regardless of technical findings.

The regulatory response: Tunisia's GDPR moment

Regulation is catching up, unevenly. Tunisia is preparing a reform of its data protection framework with 2026 as the target for alignment with GDPR style standards (Maître Haifa Guedhami, Regulations.ai). The current framework Law 2004/63 predates the modern threat landscape and lacks meaningful enforcement teeth. The proposed reform introduces stronger notification requirements, extraterritorial application for firms processing Tunisian data from abroad, and higher administrative penalties.

For firms with regional exposure, the practical implication is clear. A Tunis based company handling data from EU customers already had to comply with GDPR. It now faces an accelerating patchwork of local frameworks Morocco's Law 09/08, Algeria's Law 18/07, and Tunisia's incoming reform each with its own reporting thresholds and supervisory authorities. Cross border data flows within the Maghreb, historically informal, are becoming a compliance discipline in their own right.

The corporate exposure that gets missed

The public conversation about cyber risk in the region focuses on state linked incidents. The corporate exposure is quieter and often larger. Maroc Telecom reported $760 million in profit for 2025 (Stimson Center); a comparable telecommunications operator elsewhere would have a mature cyber operations centre, a senior chief information officer for cyber risk, and quarterly board level cyber reporting. The regional norm is still that cyber sits three layers below the C suite and reports upward through IT rather than through risk.

Three exposures deserve explicit board attention across Maghreb corporates:

Ransomware targeting operational technology in energy, water, and logistics. Attacks on OT systems bypass the traditional IT/business divide and can halt production directly. Business email compromise targeting finance functions of firms with cross border payment flows. This is the fastest growing loss category regionally and rarely reported publicly. Insider risk in workforce transitions. Contractors and departing employees remain a primary vector, particularly in sectors with high turnover and weak identity and access management.

The takeaway

Cyber risk in the Maghreb has three faces: political (state and state adjacent actors, exemplified by CNSS), regulatory (an accelerating compliance patchwork that will not stabilize before 2028), and corporate (chronic underinvestment in enterprise defences relative to the value at stake). Firms that treat any of these three in isolation will misprice their exposure.

Serious cyber resilience in the region is now a boardroom competence, not a technical function. That is the shift Women in C.R.C tracks.

---

About this paper. This is a working paper. Comments and corrections to info@carthage-consulting.com. Cite as: Women in C.R.C, "Cyber Risk Across the Maghreb", C.R.C Editorial, September 2026.