OFPPT Morocco's Vocational Training Office Confirms 100,000 Records Exposed, Actor Claims 400,000

OFPPT dates identification of the incident to April 12, 2026. Reporting in the Moroccan press places the appearance of the data on the night of April 11 to April 12, 2026. OFPPT published its communiqué on April 14, 2026, stating that the incident originated at the MyWay platform and did not affect the rest of its information systems, and that an investigation was underway by its internal IT directorate in collaboration with the competent authorities and mobilised external technical expertise.

The affected population is specific. OFPPT says all affected users had used the new MyWay orientation platform to access information about the training system and to sit a professional interests test ahead of enrolment, creating their own accounts and entering their own details. Only two public functions of the platform were involved: "s'identifier", which handles account creation, and "apprendre à me connaître", which delivers the interests test.

OFPPT states that the other components of the orientation system, including training pathways, professional project records and grade transcripts, were not affected.

The communiqué contains two defensive framings that deserve to be read carefully. The first is a data quality argument: OFPPT notes that some of the data is inaccurate or incomplete as entered by users themselves. The second is a scope limitation: OFPPT writes that it is "exclusivement et uniquement" this data concerning 100,000 users that has been exposed "à date", meaning as of the date of writing. That final qualifier is doing real work. It confirms what OFPPT had observed by April 14, 2026, and it does not foreclose a larger set.

The most consequential disclosure in the communiqué is one OFPPT volunteered. It states that the incident occurred against a background of earlier reports concerning dark web exposure risk, following which OFPPT had launched an emergency remediation plan for cyber vulnerabilities in February 2026. That plan included accelerating existing security work through external expertise and initiating procurement for data classification and data loss prevention tooling, which the communiqué marks "(en cours)", in progress.

OFPPT had roughly two months of warning and an active emergency plan when the data reached the dark web.

THE 100,000 VERSUS 400,000 QUESTION

The seller and the victim describe different objects, and both descriptions can be true at once.

The actor published a 100,000-record sample and claimed a full database of more than 400,000 records. That structure is standard commercial practice on data markets: release a fraction to establish that the goods are real, withhold the remainder as the thing being sold. A sample is evidence of possession, not a statement of inventory.

The sequence is what makes OFPPT's number legible. The sample was published on April 12, 2026. OFPPT identified the incident on April 12, 2026, and its count of close to 100,000 matches the size of that published sample. An organisation that learns of a breach from the public dump is, at the outset, measuring the dump. OFPPT's own framing is consistent with this: the figure is qualified "à date", and the communiqué describes the investigation as continuing in order to confirm the origin and measure the effective impact.

ZERO|TOLERANCE therefore assesses that OFPPT's figure is best read as a count of what surfaced publicly rather than as a measurement of what was taken, and that the seller's 400,000 claim is unverified in both directions. Nothing in the public record establishes an upper bound. OFPPT has not published platform-side extraction logs, which is the only evidence that would settle it. Readers should treat 100,000 as a confirmed floor, not as a total, and should not treat the absence of confirmation for 400,000 as a refutation of it.

A four times gap between a victim's confirmed number and a seller's claimed number most often reflects this asymmetry: the victim can count only what surfaced, the seller has an incentive to inflate, and neither has produced evidence about the remainder.

A second divergence runs alongside the first, and it points the other way. OFPPT's communiqué is the only origin in this reporting for the fact that CNI national identity numbers were in the file. Several Moroccan outlets print the CNI detail, but each relays the communiqué rather than the data. The actor-derived coverage, meaning the reporting built from the listing and the sample rather than from OFPPT, lists names, phone numbers, email addresses, enrolment details, fields of study and diploma levels across more than 500 training centres, and contains no mention of CNI numbers at all.

The victim disclosed a more sensitive data class than the seller advertised, which is not the usual direction of travel and lends weight to the CNI confirmation. The academic and administrative fields described in actor-derived reporting are correspondingly unconfirmed by OFPPT.

The listing is attributed to an individual operating under the alias anisanas2, who advertised the OFPPT database for sale and released the 100,000-record sample. No formal technical attribution has been issued. Neither OFPPT nor the Direction Générale de la Sécurité des Systèmes d'Information (DGSSI), Morocco's national information systems security authority, has publicly named or confirmed an actor.

There is no indication in any retrieved source of an established criminal brand, a ransomware affiliate, or a state nexus, and the profile is consistent with financially motivated data brokerage rather than a targeted intrusion campaign.

The incident lands in a sequence. In April 2025 Morocco's Caisse Nationale de Sécurité Sociale was breached in an incident reported to have exposed data on around two million workers and roughly 500,000 companies, which an actor using the name Jabaroot DZ claimed. Moroccan commentary following the OFPPT disclosure questioned whether institutional security has kept pace with the speed of public sector digitisation.

Confirmed by OFPPT:

• First and last names
• Telephone numbers
• Email addresses
• CNI national identity card numbers
• Segmentation of affected users as roughly 70% prospective applicants and 30% potential trainees

Explicitly excluded by OFPPT:

• Identity documents and supporting papers, which OFPPT states were not exposed
• Training pathway records, professional project data and grade transcripts

Claimed in actor-derived reporting but not confirmed by OFPPT:

• Enrolment details and administrative records
• Academic tracks and fields of study, including IT, mechanics, tourism, construction and electricity
• Diploma levels
• Coverage spanning more than 500 vocational training centres

The CNI number is the field that matters most and the one that cannot be undone. Password resets, email changes and new phone numbers are all available to an affected individual. A national identity card number is not. It is a permanent identifier used across Moroccan administrative and financial procedures, which means the combination of full name, phone number, email address and CNI number in a single row has an operational value to identity fraud that does not decay when OFPPT finishes its remediation.

The affected population makes this worse rather than better: these are young people at the point of entering vocational training, many of them at the start of their financial lives, with no prior history of fraud monitoring.