Tetouan – Morocco’s Office of Vocational Training and Employment Promotion, OFPPT, has disclosed a data leak involving approximately 100,000 users of its career guidance platform “MyWay,” while stressing that its core information systems were not breached.
OFPPT says the incident was limited in scope and likely linked to the misuse of a compromised account rather than a direct cyberattack on its systems.
In a statement issued following the incident, which was detected on April 12, the agency said the leak involved personal data circulated on the dark web in a CSV file of roughly 19 megabytes.
The dataset is believed to include information related primarily to young users registered as “interested” in guidance services, as well as prospective trainees who had previously created accounts on the platform.
According to OFPPT, the exposed data consists of information voluntarily provided by users during registration. This includes names, phone numbers, national identity card details, and email addresses.
The agency noted that no official documents or supporting files were compromised, adding that some of the data may be incomplete or inaccurate.
The institution emphasized that the breach was confined to specific functions within the “MyWay” platform, notably account creation and vocational interest assessments.
It did not affect other components of the system, such as training pathways or trainee results.
Preliminary findings suggest that the incident may have resulted from the fraudulent use of an identified account, which may itself have been compromised.
OFPPT underlined that there is no evidence at this stage of a direct intrusion into its broader information infrastructure.
The agency reported that the situation has been contained and that a detailed investigation is underway, led by its information systems department in coordination with relevant authorities and external cybersecurity experts.
The objective is to determine the exact source of the leak and assess its full impact.
OFPPT reiterated its commitment to strengthening its information security framework and ensuring the protection of users’ personal data.
