Iranian hackers publish Albanian secret service's database

Albanian authorities remain silent about a "huge leak" of data that was reportedly stolen by Iranian hackers from the country's State Intelligence Service (SHISH).

The files belonging to the State Information Service were allegedly stolen by Iranian hackers and released via a Telegram group called Homeland called Justice last week, the investigative website BalkanInsight has reported.

Two videos published on Monday on the Homeland Justice group followed November 2 claims that the data contains the names and surnames of State Information Service employees and officers, plus email addresses and in some cases mobile numbers.

The authorities have not confirmed or denied that the hackers took the data and there has been no public statement from the State Information Service.

The alleged leak is the latest in a series of online publications of information hacked from state servers in Albania.

The Tirana prosecution banned domestic media from reporting the content of the leaks in September, a move that was widely condemned by journalists and media watchdogs in Albania.

Tirana hosts a group of exiled Iranian dissidents called MEK – People’s Mujahedin of Iran.

Albania has been targeted by cyberattacks for months, which the government has connected to Iranian groups.

The staff of Iranian embassy staff in Tirana were expelled on September 7 over the cyberattacks.

Since then, the hackers have conducted other operations, targeting the Traveller Information Management System, TIMS, on September 19, which caused chaos on the borders. They also released the emails of Gledis Nano, the country’s former chief of police, on September 19.

Data from various databases was released after that, including the personal data of Prime Minister Edi Rama and Helidon Bendo, the director of the State Information Service, and his wife.

According to a US FBI report, Iranian hackers first accessed Albanian systems 14 months before the first cyberattack was reported on July 13, when government services became unavailable for some days.

“An FBI investigation indicates Iranian state cyber actors acquired initial access to the victim’s network approximately 14 months before launching the destructive cyber attack [in July], which included a ransomware-style file encryptor and disk wiping malware,” the FBI report said.