Iranian Hackers Disrupt Public Services in Tirana, Albania

TIRANA, Albania — A cyberattack by an Iranian hacker group caused significant disruption in Albania’s capital, Tirana, late last week. The group, known as Homeland Justice, reportedly took down the city’s official website and affected local government operations.

The hackers claimed responsibility for the breach, asserting that they had exfiltrated data and wiped servers. Their motive stemmed from Albania’s support of the exiled Iranian opposition group Mujahideen-e-Khalq (MEK), which has strained ties between Tirana and Iran.

The attack occurred early Friday, leaving municipal staff struggling to access internal systems and official emails. According to local media, transportation services, the issuance of passports and licenses, and digital enrollment for kindergartens were among the affected services.

Albania’s cybersecurity authority, AKSK, announced that efforts were underway to restore the affected systems. However, as of Monday morning, the municipal website was still offline.

Homeland Justice has previously targeted Albania’s parliament and telecom firms. In 2022, the U.S. sanctioned İran’s intelligence agency for a similar cyberattack that disrupted Albanian government services. U.S. cyber officials reported that Iranian-linked hackers had access to Albanian networks for over a year before launching this operation.

The Iranian Foreign Ministry has consistently denied involvement in attacks against Albania, dismissing U.S. sanctions as “baseless.” This cyberattack occurs against a backdrop of increasing tensions in the Middle East, with Israeli and U.S. officials noting heightened activity from Iranian-affiliated groups.

In recent weeks, Israeli cybersecurity authorities have warned of Iranian hackers conducting phishing campaigns, DDoS attacks, and spreading fake alerts aimed at Israeli civilian systems. The U.S. Department of Homeland Security also warned of potential retaliatory cyberattacks by Iranian-aligned actors following airstrikes on Iranian nuclear sites.