Incident Overview

Threat actor xNov has leaked the database of SUPTECH SANTE, formally named Ecole Superieure de Genie Biomedical et des Techniques de Sante, a Moroccan higher education institution specializing in Biomedical Engineering and Health Technologies. Founded in 2023 by FRDISI (Fondation de Recherche, de Developpement et d'Innovation en Sciences et Ingenierie), the school operates campuses in Mohammedia and Essaouira and hosts Jobintech, a government-backed free digital training program.

The actor explicitly states this breach is a continuation of the OFPPT breach campaign, indicating a sustained effort targeting Moroccan educational institutions. This is also the same actor behind the Smarteez / L'Oreal Morocco breach from earlier this month. The exposed data includes 231 student dossiers from the 2025/2026 academic period, with each dossier containing:

• Identity Documents: Full names, national ID numbers (CIN, Morocco's Carte d'Identite Nationale), and national ID card photos. This combination of ID number plus photo constitutes a complete identity verification package.
• Academic Documents: Diploma and degree certificate scans, enrolled training program and specialization details, and Massar codes (Morocco's national student tracking system identifier used across all educational institutions).
• Contact Information: Phone numbers, email addresses, and personal numbers.
• Personal Data: Dates of birth, gender, and inscription receipt codes.

The 231 dossiers are offered as a partial leak with an additional 500+ dossiers available for purchase with escrow accepted. Since SUPTECH SANTE focuses on biomedical engineering and health technology, these students are likely pursuing careers in medical device engineering, clinical technology, and health informatics. The exposure of their national ID photos alongside Massar codes and diploma scans creates both an identity theft risk and a potential for fraudulent credential claims in the healthcare sector.