US payments technology group Mastercard, listed on the New York Stock Exchange, published its report Africa’s Digital Defense Race on Monday, October 12. It ranks Morocco third among the African countries most exposed to cyberattacks, with 10.6% of the 69,236 events observed across the continent in 2025. The figure needs to be read carefully, because it measures the exposure recorded by a private monitoring system, not the kingdom’s actual vulnerability or the effectiveness of its defenses.
A ranking based on Mastercard Cyber Insights data
Data from Mastercard Cyber Insights puts Nigeria first with 24.4% of events, ahead of South Africa (12.6%), Morocco (10.6%), Egypt (8.8%) and Kenya (7.1%). Chad (4%), Ghana (3.9%), Algeria (3.4%), Sudan (2.2%) and Mali (1.9%) complete the top ten.
The report looks closely at four markets, Morocco, Nigeria, South Africa and Kenya, which together account for 54.7% of recorded events, or nearly 37,900 occurrences. Based on the published percentages, Morocco’s share represents roughly 7,300 events over the year. This calculation is mine, not Mastercard’s.
The methodology calls for a first caveat. These results come from the company’s monitoring system and do not constitute an exhaustive count of the attacks committed in each country. A country whose systems are more closely observed, or which has more customers within Mastercard’s scope, can mechanically appear higher in such a ranking. Morocco’s position therefore says something about its visible exposure, not about its absolute level of risk.
Why Morocco stands apart
Mastercard describes Morocco as a regional technology hub with one of the best-organized institutional cybersecurity frameworks on the continent. The study stresses its digital and economic ties with Europe, which multiply the points of contact between Moroccan and European information systems.
Shabir Ahmed, senior vice president in charge of solutions for African customers, said the kingdom “has faced numerous threats against its public institutions and major data security breaches”. This exposure concerns administrative systems and cross-border data exchanges in particular, the protection of which is a challenge for businesses and public bodies alike.
This reading matches what we have observed for several years. The more a country integrates into international value chains and data flows, the more attack surfaces it offers, without this necessarily reflecting any particular weakness.
A structured institutional framework
Morocco’s system rests on the Directorate General of Information Systems Security (DGSSI), the national cybersecurity authority. It also relies on Law No. 05-20 on cybersecurity and its implementing texts. This legislation sets out the obligations applicable to public administrations, local authorities, public institutions, critical infrastructure operators and certain categories of digital service providers. It also governs incident reporting, the oversight of sensitive systems and cooperation among the bodies concerned.
The national cybersecurity strategy to 2030 aims for better coordination between public and private actors, investment in the protection of sensitive systems and the development of specialized skills. It pays particular attention to the continuity of essential services, the protection of critical infrastructure and the handling of cyber crises.
Mastercard’s favorable assessment concerns the institutional organization. It is not an evaluation of the success rate of attacks or of the effectiveness of the protections installed in the kingdom’s companies. A solid legal framework is a necessary condition, not a guarantee of results. Detection and incident response capabilities, particularly in small and medium-sized businesses, determine in practice the extent of the damage.
A continent under growing pressure
Across Africa, cyber threats grew by 421.4% between 2016 and 2025, against 307.3% worldwide over the same period, according to the data series used by Mastercard. The report’s key figures can be summarized as follows.
- 69,236 events targeting African organizations in 2025, or roughly one every eight minutes on average
- 44% of malicious activity targets technology companies, public administrations and financial services institutions
- 27% of targeted assets are personal information, financial data and customer-facing services
- More than 60% of events for which an origin could be attributed are linked to malicious hackers and criminal organizations
The distribution differs according to national economic structures. Nigeria accounts for nearly a quarter of events, in an environment marked by the weight of financial technology companies. South Africa shows a high exposure of its financial institutions. In Kenya, the security of mobile payment services is central, given their role in everyday transactions. In Morocco, Mastercard highlights the interconnection of systems with European markets, public administrations and the protection of data exchanged between organizations.
Attacks can take the form of ransomware, account takeovers, payment fraud, identity theft or intrusions aimed at obtaining confidential data. Their cost depends on the nature of the systems affected, direct financial losses, service interruptions and the expense of restoring compromised infrastructure.
The skills gap, Africa’s digital blind spot
The report points to another major finding. Mastercard estimates that around 200,000 cybersecurity positions were vacant in Africa at the end of 2025, a shortfall equivalent to 23% of the sector’s current workforce. Organizations need specialists in intrusion detection, network protection, malware analysis and incident response.
The report does not provide a country-by-country breakdown of these vacancies, so Morocco’s specific needs cannot be quantified. The finding remains instructive for a country that is betting on the appeal of its digital services and its offshoring sector. Training and retaining cybersecurity professionals is a condition of the kingdom’s credibility with its European partners, who increasingly demand guarantees on data security.
This shortage comes alongside the rapid adoption of digital financial services. Between 2016 and 2025, the number of mobile money users grew 5.9-fold in Africa, the number of digital banking users 4.7-fold and the size of the e-commerce market 5.3-fold. Mastercard cites a projection of $1.5 trillion (about 13.878 trillion dirhams) for the African digital payments market by 2030. This estimate applies to the continent as a whole. It is a market outlook, not a forecast of revenue or transactions in Morocco.
The police and industry response
As digital usage grows, security stakes become increasingly economic. The International Criminal Police Organization (Interpol) coordinated Operation Serengeti 2.0 between June and August 2025 against several categories of cybercrime. Carried out with the authorities of eighteen African countries, it led to 1,209 arrests, the identification of nearly 88,000 victims and the dismantling of 11,432 malicious infrastructures. The authorities also recovered $97.4 million (about 901.2 million dirhams).
These results concern a police operation over a given period. They cannot be compared with the 69,236 events that Mastercard recorded separately over the whole year.
For its part, Mastercard announced on June 29 the creation of its African Cybersecurity Center of Excellence, initially deployed in South Africa and Nigeria. The program combines threat intelligence sharing, risk analysis, simulation exercises and cooperation among financial institutions, businesses and administrations. It includes an initial assessment of up to fifty organizations, using specialized intelligence from Recorded Future, a cybersecurity company owned by Mastercard.
The timeline announced when the center was created does not yet specify how Moroccan organizations might take part. This could be read as a possible opening, but nothing has been announced at this stage.
Key takeaways and open questions
This ranking is a reminder that a country’s visibility in attack statistics grows with its digital integration. Morocco, given its proximity to Europe and its ambition to be a technology hub, is naturally exposed. The institutional framework put in place since Law 05-20 and the 2030 strategy is a recognized asset, including by a foreign private player.
Several questions remain. Mastercard’s data says nothing about the success rate of attacks, or about the level of preparedness of small and medium-sized businesses, which make up most of the economic fabric. Nor does it indicate how the skills gap is distributed across sectors. Yet these are the factors that will determine whether exposure translates into real losses. Upcoming DGSSI reports and any national data on reported incidents will allow a more precise assessment.
FAQ
Is Morocco the third most attacked country in Africa?
Not exactly. It ranks third based on the events observed by Mastercard in 2025, with 10.6% of the total. This ranking does not cover all attacks committed and does not measure their success.
How many events does that represent for Morocco?
Roughly 7,300 over the year, based on a calculation from the published percentages. Mastercard did not give this figure in this form.
What is Morocco’s legal framework for cybersecurity?
It rests on Law No. 05-20, enforced by the DGSSI, and on the national cybersecurity strategy to 2030. The law imposes obligations on administrations, critical infrastructure operators and certain digital service providers.
Is Morocco taking part in Mastercard’s African center?
Not at this stage. The initial deployment covers South Africa and Nigeria, and the terms of any Moroccan participation have not been specified.
