Cyber Incident Victim: Parliament of Albania
Date:
Nov 2023
Location:
Albania
Summary
A cyberattack targeted Albania's Parliament, temporarily disrupting its services as hackers attempted to breach its data system, though officials confirmed no data was compromised. The incident coincided with reported attacks on a local cellphone provider and an airline, allegedly attributed to Iranian-linked group Homeland Justice, though independent verification was unavailable. This follows a prior cyberattack blamed on Iran, which led Albania to sever diplomatic ties after Tehran denied involvement. The recent incident occurs amid ongoing tensions related to Albania hosting exiled members of the Iranian opposition group MEK, whose spokesperson denied any connection to the attacks while disputing restrictions on their political activities in the country.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On November 27, 2023, Albania’s Parliament suffered a cyberattack that temporarily disrupted its services. Hackers attempted to infiltrate the legislative body’s data system, prompting an immediate operational halt. Parliament issued a statement on November 28 confirming the attack had not compromised system data but acknowledged experts were evaluating potential consequences. Services remained suspended pending restoration efforts. Local media reported parallel cyberattacks targeting a domestic cellphone provider and an airline on the same day. Unverified claims attributed these incidents to Homeland Justice, an alleged Iranian-linked hacker group. The Parliament attack occurred against a backdrop of escalating tensions between Albania and Iran, stemming from a July 2022 cyberattack that Albania’s government and multinational technology firms attributed to Iran’s Foreign Ministry. That earlier incident, believed to be retaliation for Albania sheltering approximately 2,500 exiled members of the Iranian opposition group Mujahedeen-e-Khalq (MEK), had prompted Albania to sever diplomatic relations with Iran in September 2022. Iran consistently denied involvement in the 2022 attack while accusing MEK of conducting cyber operations against Iranian infrastructure.
The incident triggered coordinated response measures, including digital forensic analysis by Albanian technical teams to assess attack vectors and potential latent impacts. MEK representatives explicitly denied any connection between their activities in Albania and the November cyberattacks, with spokesperson Ali Safavi asserting the group’s compliance with Albanian laws prohibiting political engagement by exiled members. This denial followed Albanian authorities’ June 2023 raid on an MEK camp to confiscate computer equipment allegedly linked to unauthorized political operations. Safavi simultaneously contested restrictions on MEK members’ political rights in Albania, advocating for freedom of expression and assembly. International allies including the United States, NATO, and the European Union reaffirmed support for Albania during the crisis, mirroring their stance during the 2022 diplomatic rupture with Iran. The cyberattack’s operational consequences remained confined to temporary parliamentary service interruptions, with no confirmed data exfiltration or secondary infrastructure damage reported.