Cyber Incident Victim: Tirana City Hall
Date:
Jul 2022
Location:
Albania
Summary
Tirana City Hall experienced a cyberattack claimed by the Iranian hacker group Homeland Justice, resulting in prolonged website downtime and disrupted access to emails and internal systems for municipal staff. The group, previously linked to attacks on Albanian government infrastructure, asserted control over digital systems, data extraction, and server wiping. This incident marks a shift toward targeting local institutions rather than national platforms, highlighting ongoing cybersecurity vulnerabilities. Authorities have initiated an investigation to assess the intrusion's scope and impact.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On June 20, 2025, Tirana City Hall’s official municipal website became inaccessible following a cyberattack claimed by the Iranian hacker group Homeland Justice. The group announced its responsibility through a video posted on Telegram, stating it had seized control of the city’s digital infrastructure, exfiltrated data, and executed server-wiping activities. Municipal employees experienced disruptions accessing official email accounts and internal systems throughout the day, hindering administrative operations. The attack marked a continuation of Homeland Justice’s activities against Albanian institutions, following its 2022 campaigns against national platforms including Parliament, INSTAT, and public service portals. Law enforcement sources confirmed the Cybercrime Unit of Albania’s State Police initiated an investigation to determine the intrusion’s scope and timeline, though Tirana Municipality had not issued a formal statement at the time of reporting. The incident underscored persistent vulnerabilities in Albania’s cybersecurity posture, echoing concerns from prior breaches attributed to the same group, which Albania’s government alleges operates under the sponsorship of Iran’s Ministry of Intelligence and Security.
The targeting of Tirana City Hall represented a tactical shift from Homeland Justice’s historical focus on national-level infrastructure to a major local institution, potentially exploiting weaker municipal defenses or amplifying symbolic impact. Forensic teams worked to assess the extent of data compromise and system integrity, while experts highlighted the attack’s alignment with a pattern of escalating cyber aggression against Albanian entities. The 2022 attacks by Homeland Justice had prompted Albania to sever diplomatic relations with Iran and expel its diplomatic mission, framing the latest breach within a broader geopolitical context. No specific details regarding the volume or sensitivity of exfiltrated data were disclosed, nor were technical specifics about the attack vector or duration of unauthorized access prior to detection. Operational disruptions remained confined to digital services, with no reports of physical infrastructure damage or ancillary impacts beyond the municipality’s immediate systems. The incident reinforced prior warnings about insufficient cybersecurity investments across Albania’s governmental layers, particularly at subnational levels historically less prioritized for defense hardening.