Albanian Prime Minister Edi Rama announced on September 7 that Iran was behind a massive cyberattack on Albanian government servers in July, and gave Iranian diplomats 24 hours to leave the country. 

The attack, which was initially thought to be a Russian act, brought down government sites just months after most government services were taken online.

“The in-depth investigation provided us with irrefutable evidence that the cyber aggression against our country has been orchestrated and sponsored by the Islamic Republic of Iran, which has engaged four groups for the attack on Albania. Among them, one of the most notorious groups of international cyber terrorism, author or co-author of previous cyber attacks on Israel, Saudi Arabia, Jordan, the United Emirates, Kuwait and Cyprus,” said Rama in a statement published by the prime minister’s website. 

“Based on the above, the Council of Ministers has decided with immediate effect the termination of diplomatic relations with the Islamic Republic of Iran,” he added. 

“This extreme measure, not at all desired but completely forced, is in full proportion to the seriousness and dangerousness of the cyber attack, which threatened to paralyze public services, delete systems and steal state data, steal electronic communications within the government system and fuelling insecurity and chaos in the country.”

US National Security Council  spokesperson Adrienne Watson also issued a statement on September 7, strongly condemning the attack. 

“We join in Prime Minister Rama’s call for Iran to be held accountable for this unprecedented cyber incident. The United States will take further action to hold Iran accountable for actions that threaten the security of a U.S. ally and set a troubling precedent for cyberspace,” said Watson, according to a White House statement.

“For weeks, the US government has been on the ground working alongside private sector partners to support Albania’s efforts to mitigate, recover from, and investigate the July 15 cyberattack that destroyed government data and disrupted government services to the public. We have concluded that the government of Iran conducted this reckless and irresponsible cyberattack and that it is responsible for subsequent hack and leak operations.” 

According to the Albanian authorities, the attack was intended to destroy the Albanian government’s digital infrastructure, paralyse public services and steal of data and electronic communications from government systems. However, all systems have since been restored. 

The Albanian government took most public services including tax payment online via the e-Albania portal as of May 1 while in-person service windows in government offices and other institutions were shut down. 

The move is intended to make it more convenient for citizens to access services and reduce corruption but at the time concerns were voiced about how elderly people and those without access to the internet would manage. 

Immediately after the attack on July 15, an in-depth investigation was launched, which quickly established that a state was behind the attack. 

Relations between Albania and Iran have been tense due to Albania’s hosting of the Mujahedin-e Khalq (MeK) exiled opposition group. 

Since 2014, around 3,000 members of MeK, also known as the People’s Mujahideen Organization of Iran (PMOI), have settled in exile in Albania. They arrived in the country saying they had suffered attacks in Iraq.

Once considered a terrorist movement by the EU and US, and still listed as a terrorist organisation by Tehran, MeK is seen by many Iran observers as a fringe, Marxist-Islamic cult-like group which lost out when the spoils were shared after the 1979 Islamic Revolution. It went on to take Iraq’s side in the 1980-88 Iran-Iraq war and has no apparent support of any significance inside Iran.

Some critics have described the group as resembling a cult, though it won much support from key figures of the Trump administration from 2016 to 2020.

Iranian diplomats have been expelled from Albania several times in recent years, following incidents that are believed to be linked to Iranian targeting of MeK exiles. 

In 2019, Albanian police claimed to have foiled a number of attacks planned by Iranian agents against MeK.

In late July this year, Fars News Agency, seen as close to the hardline Islamic Revolutionary Guard Corps, proposed that Iran should target the exiled opposition group with drones and missiles.