Zerolockersec ransomware group lists massar.men.gov.ma on its leak site

• Ransomware group: Zerolockersec
• Country: Morocco
• Sector: Government & Defense
• Announcement date: March 25, 2025

Zerolockersec claims data breach at massar.men.gov.ma

The ransomware group known as Zerolockersec has officially announced a data leak on its dedicated leak site. According to the announcement, the group claims to have obtained a significant amount of data belonging to the domain massar.men.gov.ma. This claim was made on March 25, 2025, and the group asserts that the attack occurred on the same day.

The threat actor, Zerolockersec, has published this announcement as a data leak notification. While the group has taken credit for the intrusion, public information regarding the specific identity, origins, or technical capabilities of this group remains limited. The incident highlights the ongoing risks faced by centralized digital infrastructures in the public sector.

Details of the alleged theft

According to the claims made by Zerolockersec, the volume of the stolen information is approximately 910.5 MB. The group alleges that this data was successfully extracted directly from the systems belonging to the institution. This type of claim is common in modern ransomware operations, where attackers use the threat of data exposure to pressure victims.

Despite the claim of a nearly 1 GB data theft, the group has not provided any specific details regarding the content of the allegedly leaked data. Furthermore, no screenshots or samples of the data have been provided to support the group's claims. The listing names no specific data types that were allegedly compromised.

About Massar

Massar is a centralized educational information system utilized by the Moroccan Ministry of National Education, Preschool and Sports. The platform plays a critical role in the country's administrative infrastructure, as it is used to manage student data, academic grades, and various essential school processes. Because it serves as a central hub for educational administration, the system handles a wide array of sensitive information related to the student population and educational management.

Potential impact and security implications

The alleged leak poses a significant risk to sensitive citizen data, given the vital role this institution plays in providing public services. If the claims made by the threat actor are verified, the individuals whose information is contained within the system could potentially be exposed to various secondary risks, such as identity theft or highly targeted phishing attacks. Such incidents involving public institutions can have broader consequences, potentially undermining public trust in digital infrastructure and causing disruptions in administrative processes.

Furthermore, depending on the specific nature of the data involved, such a breach could trigger legal proceedings under local data protection regulations. In many modern cyberattacks, threat actors employ double extortion tactics. This method involves not only encrypting the victim's systems to disrupt operations but also stealing sensitive data to use as leverage. If double extortion is being utilized in this case, the publication of the data could significantly increase the secondary risks to the affected individuals and the institution.

For organizations operating within the government and public service sectors, such incidents underscore the necessity of robust defensive measures. Common industry practices to mitigate these risks include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data exfiltration, and ensuring regular, offline backups. Additionally, organizations often focus on hardening their network perimeters and conducting regular vulnerability assessments to identify potential entry points for threat actors like Zerolockersec.