When a service portal is the target, the outage is the message
Iran’s attack on Albania’s e-government services aimed at public embarrassment, not ransom. When disruption is the goal, agencies have to defend a minimum visible service, contest the attacker’s story, and know who decides on attribution.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On September 7, 2022, Albania’s prime minister announced that the country was cutting diplomatic relations with Iran and ordered Iranian embassy staff to leave. He cited a cyberattack in mid-July that had taken down government websites and online public services. The United States condemned the attack the same day. On September 8, Microsoft published an analysis attributing it to Iranian state actors, who had used ransomware and a disk wiper after gaining access long before. On September 9, the Treasury Department sanctioned Iran’s Ministry of Intelligence and Security and its minister, citing the attack, and Albania reported a further attack on its border control systems. A group calling itself HomeLand Justice had claimed the July attack and leaked government data. The break was widely described as the first time a country had severed ties over a cyberattack.
Most attacks on government systems want something private: money, data or a foothold. The July attack on Albania wanted something public. It hit the e-government services through which Albanians reach much of their state, and it was timed around a planned conference in Albania of an Iranian opposition group that the country hosts. The attackers paired the outage with a public campaign of their own, posting messages and leaked documents. The disruption was the message.
Earlier in this series we looked at WhisperGate in Ukraine, where a wiper disguised as ransomware made recovery the only real plan. Albania adds a different lesson for state and local agencies. When an attacker’s goal is visible disruption, the defense has to cover three things that a ransomware playbook treats lightly. The first is keeping a minimum public service running. The second is contesting the attacker’s account of events. The third is deciding, with federal partners, who names the attacker and when.
A minimum service the public can see
Albania had moved many public services onto a single national portal. That brought real gains: faster service, lower costs and fewer trips to offices. It also gave an attacker one place to hit for maximum visibility. When the portal went dark, the effect reached every citizen who tried to use it.
U.S. states, counties and cities are consolidating in the same direction, onto shared identity systems, common portals and centralized data centers. The answer is not to retreat from consolidation. It is to decide in advance what minimum visible service the public should still see during an attack, and to engineer for it.
That minimum is usually modest. A static information page hosted separately from the main platform, so residents can see what is available and where to go. A small set of essential transactions, such as benefit payments, permit inspections or court filings, with a manual or alternate channel ready. Offices and phone lines that can take walk-in and call volume with printed procedures. Segmentation between the public portal and back-office systems limits how far an attacker can move. Recovery time targets set service by service, rather than for the platform as a whole, tell engineers what to restore first.
The minimum service only exists if it has been tested. A useful exercise assumes the portal and its identity system are both unavailable for a week and walks each essential transaction through its fallback. Exercises like this usually find dependencies nobody listed: a payment channel that verifies identity through the same directory, or a call center script that tells residents to log in online. Each finding becomes a small fix with an owner. The cost is a few days of staff time a year, against the visible failure the attacker is counting on.
Contesting the attacker’s story
In a disruption campaign, the attacker also runs an information operation. HomeLand Justice posted claims and leaked material to shape how the outage was understood, in Albania and abroad. An agency that goes silent while it investigates cedes that ground.
Contesting the story does not mean saying more than is known. It means a prepared communications plan for an attack with a political motive. That covers who speaks for the agency and how often updates come. It covers how the agency responds to leaked documents, including those that may be altered or fabricated. And it covers how to reach residents through channels the attacker does not control. Communications staff, counsel and the security team should rehearse it together, since each will want to say different things in the first hour.
Leaks need their own process. Someone must assess quickly whether published material is genuine, which individuals are exposed and what notification obligations follow. Agencies that have mapped where sensitive records live can answer those questions in days rather than weeks.
Who names the attacker
Determining who carried out an attack takes technical evidence, intelligence and often help from allies or private companies. Saying so publicly is a separate decision. It can deter and rally support. It can also escalate a conflict and expose sources. Albania’s choice sat with its national government, supported by allies and technology companies that published their own analysis.
For state and local agencies in the United States, the decision is narrower but still needs an owner. When an agency suspects a foreign state, it should engage the FBI and CISA early and generally leave public attribution to federal authorities. Within the agency, the plan should say who decides what to say about the attacker’s identity, and how that is coordinated with the governor’s office or the mayor. Elected officials under pressure will want to name someone. A pre-agreed position, written into the incident plan, prevents a premature statement that later has to be walked back.
The same coordination shapes recovery. A state-sponsored attacker may have been inside for months, as in Albania, so rebuilding identity systems and validating backups that predate the intrusion are part of the response. Federal partners, state fusion centers, National Guard cyber units and incident response retainers each bring different help on different terms. Agencies that have mapped those options and their activation steps bring help in faster.
With hindsight
Albania restored its services with allied help and strengthened its defenses, though it continued to report Iran-linked attacks in the following years. Later in September 2022, the FBI and CISA published a joint advisory describing the attack in detail, including roughly fourteen months of prior access. Iranian state-linked groups stayed active against government and critical infrastructure targets elsewhere, including U.S. water utilities’ control devices in late 2023, often pairing intrusions with public claims. Coordinated public attribution among allies became more common, usually through joint advisories. Many U.S. states built or formalized cyber response capabilities through their National Guard and fusion centers, supported by federal grants. By 2026, the core point from Albania holds: as services consolidate onto public platforms, those platforms become political targets, and agencies need plans for visible service, public narrative and attribution as well as technical recovery.