By Tirana Times
TIRANA, Albania 20 June, 2025— A sophisticated Iranian cyber group has claimed responsibility for a major attack on the official website of Tirana Municipality, disabling online services and disrupting the city’s public registration system for kindergartens and nurseries, authorities confirmed Friday.
The hacking group “Homeland Justice,” believed to be affiliated with Iranian state intelligence, announced the breach via its Telegram channel, stating that it had “extracted all data and wiped the servers” of the capital’s municipal IT infrastructure. The group also published screenshots allegedly showing server codes and backend access, raising fears of a deeper compromise of public data.
Municipal operations were severely impacted, particularly the platform for registering children in public childcare facilities. The process was due to close on June 22, but has now been indefinitely postponed. “The platform e-femijet.tirana.al is non-functional,” said the Directorate of Nurseries and Kindergartens, adding that new registration deadlines will be announced once systems are restored.
Cyber Retaliation and MEK: The Underlying Trigger
Homeland Justice, which has taken credit for previous cyberattacks on Albanian government systems in 2022 and 2023, linked the latest attack to Albania’s continued hosting of more than 3,000 members of the Iranian opposition group Mujahedin-e Khalq (MEK). The group, formerly designated as a terrorist organization by the U.S. and EU, has been based in a secured compound in Manëz, near Durrës, since 2013.
In a defiant statement posted Friday, the hackers accused Albania of sheltering “terrorists” and granting them fake passports and ID cards. “We warned you to expel the terrorists from your territory,” the post read. “Instead, you welcomed them as legitimate refugees. Now, your leaders are being punished.”
This message echoes earlier Iranian complaints that MEK uses Albania as a base to orchestrate propaganda and possibly cyber operations against the Islamic Republic. A police raid on the MEK camp in June 2023 — authorized by Albania’s anti-corruption body SPAK — further inflamed tensions. Authorities at the time cited suspicions that the camp may have been used to conduct hostile cyber activities against Iran.
A History of Escalation
The current breach is the latest episode in a worsening cyber conflict between Tehran and Tirana. In July 2022, Homeland Justice launched a coordinated cyberattack that crippled Albania’s digital government portal, e-Albania, disrupting essential services from school enrollment to property registration. The U.S., Microsoft, and cybersecurity firm Mandiant later attributed the attack to Iranian state-backed actors.
Citing “undeniable evidence” of Iran’s responsibility, Prime Minister Edi Rama in September 2022 severed diplomatic relations with Tehran — the first such case globally resulting from a cyberattack. All Iranian embassy staff were expelled within 24 hours.
The United States quickly imposed sanctions on Iran’s Ministry of Intelligence and its then-minister Esmail Khatib for their involvement in the cyberattack. Washington called Iran’s actions a “flagrant violation of norms” for state conduct in cyberspace and reaffirmed its full support for Albania, a NATO ally.
Renewed Geopolitical Pressures
The new attack also coincides with heightened regional and global tensions. Albania has been among the staunchest European supporters of Israel in its standoff with Iran, drawing additional ire from Tehran. A Western diplomat told Tirana Times anonymously in 2023 that “by hosting MEK, Albania placed a geopolitical time bomb in its own backyard.”
Analysts warn that the cyber conflict may only intensify. Homeland Justice has signaled further leaks, including alleged internal emails, documents, and diplomatic cables. In previous attacks, the group published emails belonging to Prime Minister Rama and other top officials, including Albania’s ministers of foreign affairs, defense, and interior.
Homeland Justice operates under a dual narrative: presenting itself as an anti-corruption vigilante force targeting Albanian elites, while simultaneously executing state-sponsored retribution on behalf of Tehran. According to Microsoft and Mandiant, its tactics include data theft, system paralysis, and psychological pressure via data leaks and public shaming.
Fragile Digital Sovereignty
Albania’s growing exposure to cyberattacks underscores the country’s fragile digital sovereignty. Despite international assistance and NATO cooperation, critical infrastructure remains vulnerable to sophisticated breaches. The repeated targeting of state systems — from e-government portals to municipal servers — has raised alarms in Brussels and Washington.
“Cybersecurity has become Albania’s most urgent national defense frontier,” one analyst observed. “The MEK file is no longer just about asylum or politics — it has become a vector for hybrid warfare.”
The government has yet to issue an official statement following this latest breach. Anuela Ristani, currently serving as acting mayor of Tirana, has not commented on the disruption. Her predecessor, Mayor Erion Veliaj, is currently in custody on unrelated corruption charges.
As Albania grapples with the fallout, many observers warn that Tehran’s cyber war is far from over — and that Tirana’s strategic choices have placed it on the front lines of a conflict it may struggle to contain.
New Front in Israel-Iran Conflict: Albania’s Clear Alignment
The latest cyberattack comes as regional tensions escalate between Israel and Iran. Albania has clearly aligned itself with Israel, joining Western allies in condemning Iran’s nuclear ambitions and its recent attacks on Israeli targets.
Foreign Minister Igli Hasani and President Bajram Begaj issued strong statements earlier this week, calling on Iran to “immediately halt its nuclear program” and “cease all acts of aggression against Israel.” The public stance has added another layer to the already complex confrontation between Albania and Iran.
A Western diplomat told Tirana Times that Albania’s alignment “has not gone unnoticed in Tehran,” and that the country may continue to pay a price for being on the front lines of this broader geopolitical divide.
The post Iran Hacks Tirana Municipality in Retaliation Over MEK appeared first on Tirana Times.
