Iran’s Hackers Return to Tirana — and Their Timing Was Not Accidental

Homeland Justice’s timing was not coincidental. The attack landed on the day Tirana was supposed to host Israeli cybersecurity firms for a government-patronised conference.

by the Newsroom (Tirana)

The Iranian-linked hacker group Homeland Justice breached the Albanian parliament’s IT infrastructure on 10 March, deleting data from staff accounts and publishing internal emails on Telegram — the same day an Israeli-Albanian cybersecurity summit was scheduled to open in Tirana.

The Israel-Albania Cyber Summit, organised by the Israeli-linked platform IMPROVATE and held under the patronage of Prime Minister Edi Rama, had been planned for that morning at the MAK Albania Hotel. The agenda brought together Israeli cybersecurity companies with Albanian government ministries, critical infrastructure operators, and private-sector leaders. Rama was listed as the opening speaker; the Ministers of Interior, Defence, Finance, and Infrastructure were among the participants. The summit has since been postponed following the outbreak of hostilities between Iran and Israel, according to notification received by the Tirana Examiner.

The coincidence of dates is not one. Homeland Justice selected its moment with characteristic precision.

The Assembly confirmed the breach in an official statement later that day, saying that unauthorised access had been detected around 21:00 the previous evening and that data had been deleted from employee user accounts. Core systems remained functional. A joint technical and investigative team drawn from the National Cybersecurity Authority, the State Police’s Cybercrime Directorate, and the Defence Ministry’s Cyber Command is working on analysis and recovery. International partners, unnamed, have offered technical support.

Homeland Justice framed the attack in terms it has used before. In a Telegram post accompanying the leaked emails, the group claimed access to “all conversations and correspondence of corrupt Assembly members over recent months” and warned that Albania’s hosting of the MEK — the Iranian opposition movement resident at the Manza camp — would not go unanswered. The content of the published emails was administratively unremarkable. That is the point: Homeland Justice was demonstrating access, not deploying a specific payload.

This is the group’s established logic against Albania. Previous operations have leaked personal data, banking details, and mobile numbers of Albanian citizens. The parliament breach escalates the symbolic register. But the timing transforms it into something more pointed — an attack on the legislature on the very day the government was due to sit down with Israeli cyber firms to discuss exactly the vulnerabilities just demonstrated. The message was directed simultaneously at Tirana and Tel Aviv.

The geopolitical context is not background noise. Albania has aligned itself closely with Washington and Israel at a moment when Iran is in direct military confrontation with both. The MEK hosting arrangement, absorbed under sustained American pressure, has always carried a cost. Homeland Justice’s periodic operations are that cost made visible — each calibrated to embarrass without crossing a threshold that would demand a proportionate response.

NATO’s reaction was a single sentence of boilerplate supporting “a free, open, peaceful and secure cyberspace.” It accurately describes the limits of collective cyber defence when a threat is deniable and subcritical. The bilateral cooperation framework the IMPROVATE summit was designed to advance now sits postponed, alongside a parliament still assessing the full extent of the damage.

What the forensic teams establish in the coming days will matter. If the access ran deeper than the Assembly’s initial statement acknowledges — if correspondence was exfiltrated rather than merely deleted — the political consequences will be harder to manage. For now, the official line holds that the damage was limited. Homeland Justice had already made its point.