Cyber Incident Victim: Tirana City Hall
Date:
Jun 2025
Location:
Albania
Summary
Tirana City Hall's official website has been offline after a cyberattack claimed by the Iranian hacker group Homeland Justice, which said it gained control of the city's digital infrastructure, extracted data and wiped servers. Municipal staff have reported difficulties accessing emails and internal systems, prompting the State Police Cybercrime Unit to launch an investigation into the scope and timeline of the intrusion. The group, known for previous attacks on Albanian government portals that led to severed diplomatic ties with Iran, appears to be targeting local institutions to exploit weaker defenses or send a political message.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Tirana City Hall’s official municipal website went offline early on Friday morning after a cyberattack that the Iranian hacker group Homeland Justice claimed responsibility for in a video posted on Telegram. The group, which had previously targeted Albanian government infrastructure in 2022 and was allegedly sponsored by the Iranian Ministry of Intelligence and Security, said it had gained control over the city’s digital infrastructure, extracted data, and wiped servers. Municipal staff reported difficulties accessing official emails and internal systems throughout the day, while the Municipality of Tirana issued no formal statement about the incident. Law enforcement sources confirmed that the Cybercrime Unit of the State Police launched an investigation to determine the scope and timeline of the intrusion.
The attack disrupted normal operations at Tirana City Hall, preventing employees from using email and other internal platforms that rely on the municipal network. Homeland Justice’s assertion of data extraction and server wiping raised concerns about the potential loss or compromise of sensitive administrative information. Although no specific details about the data taken were provided, the group’s claim of control over digital infrastructure indicated a significant breach of the city’s technological defenses. The incident echoed earlier 2022 attacks by the same group on national portals such as Parliament’s website, INSTAT, and various public service platforms, which had prompted Albania to sever diplomatic ties with Iran and expel its diplomatic mission.
Digital forensic teams are now examining the compromised systems to assess the level of access achieved by the attackers and the integrity of any remaining data. The breach, which targeted a major local institution rather than a national platform, has been interpreted by observers as a possible shift in tactics toward exploiting weaker local-level defenses or delivering a political message through symbolic targets. As the investigation continues, authorities are working to establish a full timeline of the intrusion and to implement measures aimed at restoring affected services.