Cyber Incident Victim: Albania
Date:
Nov 2023
Location:
Albania
Summary
A cyberattack targeted Albania's Parliament, causing temporary service disruptions as hackers attempted to infiltrate its data system, though no data compromise was confirmed. The incident coincided with reported attacks on a local cellphone provider and airline, with unverified claims attributing the activity to Iranian-linked group Homeland Justice. This follows a prior cyberattack against the country attributed to Iran, which led to severed diplomatic ties after Albania sheltered exiled Iranian opposition group MEK members. Authorities recently raided an MEK camp over alleged prohibited political activities, while the group denied involvement in the cyberattacks and contested restrictions on their rights. The United States, NATO, and the European Union supported Albania amid these tensions.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On December 1, 2023, Albania’s Parliament reported a cyberattack that disrupted its services after hackers attempted to infiltrate its data system. The attack occurred on Monday, November 27, prompting a temporary halt in parliamentary operations, though officials stated no data was compromised during the breach. Parliament issued a declaration confirming experts were investigating potential consequences while working to restore system functionality at an unspecified later time. Local media outlets linked this incident to broader cyberattacks targeting a domestic cellphone provider and an air flight company on the same day, attributing the actions to an alleged Iranian-based group known as Homeland Justice, though independent verification of this claim remained unavailable. This marked the second major cyber incident affecting Albanian institutions within 18 months, following a July 2022 attack that disrupted government digital services.
The 2022 cyberattack, attributed by Albanian authorities and multinational technology firms to Iran’s Foreign Ministry, was interpreted as retaliation for Albania hosting approximately 2,500 exiled members of the Iranian opposition group Mujahedeen-e-Khalq (MEK) since 2013. In response, Albania severed diplomatic relations with Iran in September 2022, receiving public support from the United States, NATO, and the European Union. Iran consistently denied involvement in both the 2022 and 2023 incidents, counter-accusing MEK members of conducting cyberattacks against Iranian infrastructure. Tensions escalated in June 2023 when Albanian police raided an MEK camp to confiscate computer equipment allegedly used for prohibited political activities, as MEK exiles are legally barred from political engagement under Albanian law. MEK spokesperson Ali Safavi rejected any connection between the group’s activities and the December 2023 cyberattacks, simultaneously contesting restrictions on members’ political rights in Albania. The Parliament’s systems remained offline with no confirmed restoration timeline as of the reporting date, while investigations into the attack’s technical and geopolitical implications continued.