When a service portal is the target, the outage is the message

The week

In the first week of September 2022, Albania cut diplomatic ties with Iran over a computer attack. Countries rarely sever relations at all, and almost never over a cyberattack.

On September 7, 2022, Albania’s prime minister announced that the country was cutting diplomatic relations with Iran and ordered Iranian embassy staff to leave. He cited a cyberattack in mid-July that had taken down government websites and online public services. Albania, like many countries, had moved much of daily life with the state online, so the outage reached ordinary citizens trying to get things done. The U.S. Treasury later described the July attack as forcing the government to suspend its online public services.

The July attack and its timing

The attack struck on July 15. Three days later, a group calling itself HomeLand Justice claimed it and posted messages attacking the Mujahedin-e Khalq (MEK), an Iranian opposition group whose members Albania has hosted since the previous decade. The MEK had planned a large conference in Albania later that month. It was canceled after warnings of a possible terrorist threat. Microsoft later noted that the attack came about a week before the planned summit.

The name HomeLand Justice presented the attackers as a cause rather than a government agency. From late July to mid-August the group released Albanian government documents in installments, some of them promoted through publicized online polls. The leaks were designed to be seen.

Attribution, condemnation and sanctions

The United States condemned the attack the same day Albania broke off relations. On September 8, Microsoft published an analysis attributing it, with high confidence, to Iranian state actors. Attribution is the process of working out, and saying, who was behind an attack. It is harder than it sounds, because attackers hide their tracks and sometimes leave false clues.

Microsoft’s account was detailed. The attackers had first gained access in May 2021, more than a year before the outage, by exploiting a flaw in an internet-facing Microsoft SharePoint server that had not been patched. They had then spent months reading and copying email. In July 2022 they deployed ransomware, software that scrambles systems so they cannot be used, followed by a disk wiper, which is more destructive still: it erases data outright, with no key that could ever bring it back. Microsoft linked the operation to several Iranian groups, some tied to Iran’s Ministry of Intelligence and Security, each handling a different stage.

On September 9, the Treasury Department sanctioned Iran’s Ministry of Intelligence and Security and its minister under the executive order that targets malicious cyber activity. The designation blocked any of their property within U.S. jurisdiction and generally barred U.S. persons from dealing with them. Treasury cited the Albania attack and the leaking of government documents and residents’ personal information. NATO allies also condemned the attack. Iran denied responsibility.

The same day, September 9, Albania reported a further attack, this time on its border control systems, the computers that record who enters and leaves the country. A later FBI and CISA advisory described a September wave of attacks using similar methods. It assessed that the wave was likely retaliation for the public attribution and for the break in diplomatic relations.

Several features made the case unusual. Albania has been a NATO member since 2009, so an attack on its government was an attack on an alliance member. A major technology company published a detailed attribution within a day of the diplomatic break. Sanctions followed within two days. Treasury’s release placed the attack alongside other activity it attributed to the same ministry, including the groups known as MuddyWater and APT39. That framed Albania as one episode in a longer pattern rather than an isolated event.

The attackers’ own messaging was part of the operation from the start. According to the FBI and CISA, they left anti-MEK messages on the desktops of affected computers as well as online. Microsoft reported that social media personas created in May 2021, around the time of the first intrusion, helped amplify the campaign. The public story had been prepared as carefully as the technical attack.

The break was widely described as the first time a country had severed ties over a cyberattack. For governments everywhere, and for the state and local agencies that run public services in the United States, it was a vivid example of a different kind of attack: one where the outage itself, and the public embarrassment that comes with it, is the point.

Take a resident of Tirana in July 2022 trying to renew a document, check a record or pay a fee. For years, the government had been steering people online, with good reason: it was faster and cheaper for everyone. That morning, the portal simply does not load. Then, online, a group no one has heard of starts posting messages and documents, claiming responsibility and telling its own story about why. The resident does not know who to believe or where to go.

Most attacks on government systems want something private: money, data or a foothold. The July attack on Albania wanted something public. It hit the e-government services through which Albanians reach much of their state, and it was timed around a planned conference in Albania of an Iranian opposition group that the country hosts. The attackers paired the outage with a public campaign of their own, posting messages and leaked documents. The disruption was the message.

U.S. state and local agencies are unlikely to be a foreign intelligence service’s first choice. They are still exposed to the same pattern. Hacktivist groups, criminal crews seeking attention and state-linked operators all use visible disruption to make a point. In October 2022, a few weeks after Albania broke with Iran, the pro-Russian group Killnet claimed denial-of-service attacks that briefly knocked several U.S. state government websites offline. The technical damage was slight. The headlines were the goal.

Albania holds a lesson for state and local agencies. When an attacker’s goal is visible disruption, the defense has to cover three things that a ransomware playbook treats lightly. The first is keeping a minimum public service running. The second is contesting the attacker’s account of events. The third is deciding, with federal partners, who names the attacker and when. First, some background on the technology involved.

Front doors, wipers and attackers who wait

“E-government” simply means delivering public services online: applying for permits, paying taxes, requesting certificates, checking benefits. Many countries, and many U.S. states and cities, have gone further and built a single front door, a national or statewide portal where residents log in once and reach dozens of services behind it. Behind that front door is shared plumbing: a common identity system that checks who you are, shared databases, and data centers that host it all.

That design is efficient. It is also, from an attacker’s point of view, a single, highly visible target. Knock out the front door, or the identity system behind it, and dozens of services go dark at once.

The attackers’ tools mattered too. Ransomware locks systems and, in criminal hands, comes with a ransom demand. A wiper simply destroys. When a state actor uses either, the goal is often damage and disruption rather than payment. Using ransomware as cover can also muddy the waters for a while, making a political attack look like ordinary crime.

Finally, there is the question of time. Microsoft said the attackers had gained access long before the July outage. Security professionals call this “dwell time”: the period an intruder spends inside a network before being detected. A long dwell time lets an attacker learn how systems connect and collect documents to leak later. It also lets them position tools so that, when the moment comes, they can do the most visible damage in the shortest time.

How an old flaw became a year of access

The published accounts show a sequence that any agency can map against its own controls. Each step had an ordinary defense that was missing or too slow.

1. Entry. The attackers exploited a SharePoint flaw for which Microsoft had released a fix in 2019. The server faced the internet and had not been patched.
2. Foothold. They installed small web-based back doors on the server and, according to Microsoft, used a misconfigured service account that had local administrator rights.
3. Email. Over the following months they searched mailboxes on the Exchange email system, including administrators’ mailboxes, and added an account to a powerful management group. Investigators later saw gigabytes of data leave the email servers.
4. Remote access. In the months before the attack, they logged in through the government’s VPN using compromised accounts and harvested more credentials.
5. Impact. They deployed the ransomware and then the wiper, and when defenders responded, they switched to another destructive tool.

The defenses map one to one. Internet-facing servers need patching on a deadline, with known exploited flaws first. Service accounts need the minimum rights and an owner. Large transfers out of email servers should trigger an alert. VPN access needs phishing-resistant multi-factor authentication. None of those controls is exotic, and each would have shortened the attackers’ year.

Why visible damage outruns technical damage

Microsoft reported that the destructive attack affected less than a tenth of the environment it examined. The public effect was far larger, because the damaged portion included the front door. That gap is the core of a disruption attack. An attacker who hits the shared portal or the identity service can make a whole government look broken while touching a small share of its systems.

The gap also changes how leaders should measure an incident. Counting servers affected understates the harm. Counting services residents could not reach, and for how long, measures what the attacker was trying to achieve.

A minimum service the public can see

Albania had moved many public services onto a single national portal. That brought real gains: faster service, lower costs and fewer trips to offices. It also gave an attacker one place to hit for maximum visibility. When the portal went dark, the effect reached every citizen who tried to use it.

U.S. states, counties and cities are consolidating in the same direction, onto shared identity systems, common portals and centralized data centers. The answer is not to retreat from consolidation. It is to decide in advance what minimum visible service the public should still see during an attack, and to engineer for it.

That minimum is usually modest. A static information page hosted separately from the main platform, so residents can see what is available and where to go. A static page is a simple web page with no logins or databases behind it, which makes it hard to break and quick to put up somewhere else. A small set of essential transactions, such as benefit payments, permit inspections or court filings, with a manual or alternate channel ready. Offices and phone lines that can take walk-in and call volume with printed procedures.

Engineering the status page

A status page only helps if the attack cannot reach it. That means more than separate hosting. The page should sit with a different provider, under a domain whose records are managed outside the main platform. Editors should sign in with accounts that do not live in the government’s own directory. If the people who update the page log in through the identity system that is down, the page will stay stale exactly when it matters.

Content can be drafted in advance. Templates for “service unavailable”, “use this alternate channel” and “deadline extended” can be approved by counsel and communications staff ahead of time, leaving only the specifics to fill in. A named owner, a deputy and a monthly test publication keep the arrangement alive.

Deadlines and legal clocks

Many government transactions carry legal deadlines: tax filings, license renewals, benefit certifications, permit expiries, appeal windows. When the portal is down, residents miss them through no fault of their own. Agencies need to know in advance who has authority to extend or waive each deadline, whether that power sits in statute, rule or an emergency declaration, and how the extension will be published. That map belongs in the continuity plan. Counsel should review it, because the answers differ by program and jurisdiction.

Segmentation between the public portal and back-office systems limits how far an attacker can move. Segmentation means dividing a network into separate compartments with controlled doors between them, so a breach in one compartment does not flood the rest. Recovery time targets set service by service, rather than for the platform as a whole, tell engineers what to restore first.

Testing the minimum

The minimum service only exists if it has been tested. A useful exercise assumes the portal and its identity system are both unavailable for a week and walks each essential transaction through its fallback. Exercises like this usually find dependencies nobody listed: a payment channel that verifies identity through the same directory, or a call center script that tells residents to log in online. Each finding becomes a small fix with an owner. The cost is a few days of staff time a year, against the visible failure the attacker is counting on.

Suppose a state runs a single resident portal for unemployment benefits, vehicle registration and business licenses, all behind one login. Its exercise reveals that if the login system fails, benefit claimants cannot certify their weekly eligibility at all, and the phone center has no way to take certifications by hand. The fix is a paper certification form, a phone script and a rule for processing them, drafted in an afternoon and approved before anyone needs it. In a real attack, that is the difference between delayed payments and no payments.

How the minimum differs by level of government

The right minimum depends on who runs the service. A state portal fronts high-volume, deadline-driven programs such as benefits, taxes and vehicle registration, so its minimum is mostly about alternate channels and deadline relief. A county runs records, courts, elections support and public health, where the minimum is often about in-person counters and paper filings. A city’s permits, inspections and utility billing can usually wait a few days, provided residents are told.

Shared dependencies cross those lines. A county that relies on a state identity service, or a state program that checks eligibility against federal data, inherits the availability of systems it does not run. The exercise should therefore include the upstream services each transaction calls, and a named contact at each.

The minimum also has to serve people who cannot use digital channels at all. Counter capacity, interpreters and phone lines are the fallback for residents without a smartphone or a reliable connection. Those residents are often the most dependent on the services in question, so the walk-in plan matters as much as the static page.

Contesting the attacker’s story

In a disruption campaign, the attacker also runs an information operation. An information operation is a deliberate effort to shape what people believe, using posts, leaks and messages timed for effect. HomeLand Justice posted claims and leaked material to shape how the outage was understood, in Albania and abroad. Microsoft also reported social media personas, created around the time of the initial intrusion, that amplified the campaign and did not appear to be real people. An agency that goes silent while it investigates cedes that ground.

Contesting the story does not mean saying more than is known. It means a prepared communications plan for an attack with a political motive. That covers who speaks for the agency and how often updates come. It covers how the agency responds to leaked documents, including those that may be altered or fabricated. And it covers how to reach residents through channels the attacker does not control. Communications staff, counsel and the security team should rehearse it together, since each will want to say different things in the first hour.

The tension is real. The communications team wants to reassure quickly. Counsel wants to avoid statements that create legal exposure or prejudice an investigation. The security team wants to avoid tipping off attackers who may still be inside. A rehearsed plan settles those trade-offs in advance, so that the first public statement comes out in hours rather than days and does not need to be retracted.

Triage for leaked documents

Leaks need their own process. Someone must assess quickly whether published material is genuine, which individuals are exposed and what notification obligations follow. Agencies that have mapped where sensitive records live can answer those questions in days rather than weeks. Altered documents are a particular risk in politically motivated leaks: a genuine file with a few changed lines can do more damage than an obvious forgery, so the assessment has to check content as well as origin.

The triage runs in a fixed order. First, match each leaked file against the agency’s own copy, if one survives, and record any differences. Second, check document metadata for signs of editing after the date of theft. Third, identify the people named and the categories of personal data exposed. Fourth, decide what can be said publicly about authenticity, and when. A small team with a records officer, a forensic analyst and a lawyer can work through a batch in a day if the procedure is written down.

Installment leaks change the rhythm. HomeLand Justice released material over weeks, promoting some releases with public polls. Each release restarts the news cycle and the triage. Agencies should plan for a campaign of releases, with a standing team, rather than a single disclosure event.

The first statement

The first public statement sets the frame for everything after it, so its contents should be agreed in advance. It should say which services are affected and which still work. It should give residents an alternate channel and tell them whether deadlines will be extended. It should say that the agency is working with federal partners, without naming an attacker. And it should give a time for the next update. A statement that covers those five points, issued within hours, leaves the attacker’s posts competing with practical information rather than with silence.

Later statements follow the same skeleton, adding what has been restored and what has been learned about any leaks. Keeping the structure fixed makes it easy for residents and journalists to see what has changed, and hard for the attacker to claim the agency is hiding something.

Personal data and platform requests

Treasury noted that the Albania leaks included residents’ personal information. Once that happens, the agency has duties to the people exposed as well as a reputation to defend. Notification rules vary by jurisdiction and by type of data, so counsel should map them in advance.

Agencies can also ask social media and hosting platforms to remove posts that expose personal data or violate platform rules. That is worth doing, but it has trade-offs. Removal requests can draw more attention to the material, and copies tend to reappear elsewhere. Requests work best when they focus on specific personal data and come with a clear explanation of the harm.

The case for saying less

The strongest argument against an active public response is that it amplifies the attacker. Every rebuttal repeats the claim. Every statement about a leak tells more people where to find it. Some security teams argue that the best answer to an information operation is to restore service and say little.

That argument holds for a minor defacement that few people notice. It fails when residents cannot reach services, because they need practical information regardless of the attacker’s narrative. The useful middle path is to focus public statements on what residents can do, and to say as little as possible about the attacker’s claims beyond whether leaked material is authentic.

Who names the attacker

Determining who carried out an attack takes technical evidence, intelligence and often help from allies or private companies. Saying so publicly is a separate decision. It can deter and rally support. It can also escalate a conflict and expose sources. Albania’s choice rested with its national government, supported by allies and technology companies that published their own analysis.

The September wave showed the cost side plainly. The FBI and CISA assessed that the second round of attacks was likely retaliation for the public attribution and the break in relations. Naming an attacker can invite a response, and the agency that runs the targeted systems bears it.

The federal division of labor

For state and local agencies in the United States, the decision is narrower but still needs an owner. When an agency suspects a foreign state, it should engage the FBI and CISA early and generally leave public attribution to federal authorities. CISA is the Cybersecurity and Infrastructure Security Agency, the federal body that helps protect civilian networks.

The federal roles are set out in Presidential Policy Directive 41, issued in 2016. The FBI leads threat response, meaning the investigation and attribution of the attacker. CISA leads asset response, meaning technical help to protect and restore affected systems. The intelligence community supports both. Knowing which agency does what saves time in the first day, when a county or state is deciding whom to call.

Federal attribution can move quickly when the evidence is clear. In October 2020, the Director of National Intelligence and the FBI publicly attributed threatening emails sent to U.S. voters to Iran within days of their appearance. State and local leaders who wait for federal attribution are not necessarily waiting long.

Sanctions add another consideration. Once Treasury designates a group or its sponsor, payments to it can raise sanctions issues for the payer. A state attacker that uses ransomware as cover may present a ransom note that looks like an ordinary criminal demand. An agency tempted to treat it that way needs law enforcement and counsel involved before any contact, because the identity of the recipient matters legally.

Inside the agency

Within the agency, the plan should say who decides what to say about the attacker’s identity, and how that is coordinated with the governor’s office or the mayor. Elected officials under pressure will want to name someone. A pre-agreed position, written into the incident plan, prevents a premature statement that later has to be walked back.

Attribution also has financial consequences that are easy to overlook. Many cyber insurance policies exclude losses from war, and in 2022 the Lloyd’s market began requiring standalone cyber policies to carry clear exclusions for certain state-backed attacks, starting in 2023. The pharmaceutical company Merck spent years in dispute with its insurers over losses from the 2017 NotPetya attack. A New Jersey appeals court decided in Merck’s favor in 2023, and the case showed how much can turn on how an attack is characterized. Agencies with cyber coverage should ask counsel and their broker how a public attribution to a foreign state would interact with their policy, before they make one.

Recovery when the attacker is a state

The same coordination shapes recovery. A state-sponsored attacker may have been inside for months, as in Albania, so rebuilding identity systems and validating backups that predate the intrusion are part of the response. If the intruder was present when a backup was made, restoring that backup may simply restore the intruder. Federal partners, state fusion centers, National Guard cyber units and incident response retainers each bring different help on different terms. A fusion center is a state or regional hub where law enforcement and other agencies share threat information; an incident response retainer is a pre-arranged contract with a specialist firm that can arrive quickly. Agencies that have mapped those options and their activation steps bring help in faster.

How a disruption attack plays out inside an agency

Inside an agency, the pressures of the first days arrive in a predictable order.

In the first hours, the technical team sees services failing and has to decide quickly whether to pull systems offline to stop the damage spreading. That decision itself makes the outage bigger and more visible, which is exactly what the attacker wants, but leaving systems connected may be worse. Meanwhile, calls start arriving from residents, staff and journalists.

Within the first day, the attacker’s public campaign usually begins. Posts claim responsibility, offer a political reason and promise leaks. Journalists now have a story with a villain and a motive, and they will ask the agency to respond to the attacker’s claims before the agency fully understands what happened.

Over the following days, leaked material appears in installments, each one a fresh news cycle. Elected officials ask who did it and what is being done. Staff improvise workarounds. And the technical team, under enormous pressure to restore services quickly, has to balance speed against the risk that the attacker, after long dwell time, has left other ways back in.

Assume the attacker can read your email

In Albania, the attackers had spent months inside the email system, including administrators’ mailboxes. Responders who coordinate by email in that situation may be briefing the adversary. An agency should keep an out-of-band channel ready for incident coordination: a separate messaging service, accounts not tied to the main directory, and a printed contact list for the core team. Setting it up costs little. Setting it up during an attack is slow and risky.

Expect the attacker to react

The attackers in Albania changed tools when defenders responded, switching to a different destructive program. Disruption campaigns are contests, not single events. Containment steps should be planned to happen together where possible, so that the attacker does not see the first move and use the remaining access to do more damage before the next.

Every one of those pressures is easier to handle with a plan written in advance. Not one of them is primarily a technology problem.

Treating shared platforms as critical infrastructure

A practical shift for many governments is to treat their shared portals and identity systems the way a utility treats a power substation: as infrastructure whose failure affects everyone downstream. That changes how they are funded, tested and governed.

In practice, it means the platform has a named owner at a senior level as well as a technical team. It means a regular, funded program of resilience testing, including exercises that assume the worst. It means the agencies that depend on the platform know what it would mean for their services if it went down, and have fallbacks of their own. And it means security monitoring on the platform is sized to match its importance, with the aim of shortening the dwell time an attacker could enjoy.

Funding and governance

Shared platforms often struggle for money because no single agency owns them. Chargeback models, where each agency pays a share based on use, keep costs visible but tend to squeeze resilience spending that no one agency wants to fund. Central appropriations protect that spending but weaken the link to demand. Either model works if the resilience budget is ring-fenced and reported separately, so it cannot be traded away for new features.

A governance board of the main dependent agencies gives the platform owner a place to agree recovery priorities. Without one, every agency expects its service to come back first, and the decision is made under pressure on the day.

Measures that show the risk

Three measures say more about a platform’s exposure than any maturity score. The first is how long internet-facing systems take to receive critical patches, with known exploited flaws tracked separately. Federal civilian agencies have been bound since late 2021 by a CISA directive to fix flaws in CISA’s Known Exploited Vulnerabilities catalog within set deadlines. State and local bodies are not bound by it, but many use the catalog the same way. The second measure is the share of administrative and remote access protected by phishing-resistant multi-factor authentication. The third is how quickly an exercise team can confirm that the static status page and alternate channels work.

The case for spreading the risk

Some argue the opposite: that a government made of many separate systems is harder to knock over in one blow. There is something in that. Diversity limits the blast radius of any single failure. The weakness is that dozens of small systems are usually defended unevenly, with thin staff and slow patching, and an attacker needs only the weakest one.

This is no argument against consolidation. A well-run shared platform can be better defended than dozens of separate ones. It simply needs to be defended, and planned for, in proportion to what depends on it.

Trust is what the attacker is after

In a disruption attack the stakes are as much about trust as technology. Residents who cannot reach services judge the government, not the attacker. Staff on phone lines and at counters absorb the frustration. Leaked records can expose individuals and create legal duties to notify them. Elected officials face pressure to explain and to act. And the costs of rebuilding systems after a long intrusion can dwarf the cost of the preparation that would have limited the damage.

Private organizations are not exempt. Banks, hospitals and utilities that provide visible public services can be chosen for the same reasons: an outage people notice sends a message. U.S. banks learned this a decade before Albania. From 2011 to 2013, a sustained campaign of denial-of-service attacks disrupted the public websites of dozens of financial institutions, and in 2016 the Justice Department indicted seven Iranians linked to the campaign. The attacks did not reach account data. They made online banking unavailable, which was the point.

What trust costs to rebuild

Trust is lost unevenly. Residents who could not get a benefit payment or a document on time remember it longer than residents who read about a leak. Staff who were left without guidance at the counter remember that too. The recovery plan should therefore include a short after-action report to the public: what happened to services, what the agency did, and what will change. Publishing it closes the story on the agency’s terms rather than the attacker’s.

The underlying question for any leader is simple to state. If someone wanted to embarrass us publicly, which of our systems would they choose, and what would the people who depend on us see on that day? An organization that can answer both parts, and has a plan for the second, is much harder to turn into a headline.

What prepared governments had settled

• A defined minimum service. Leaders have agreed what residents must still be able to see and do during an attack, and it has been tested.
• Separate, simple fallbacks. A status page hosted elsewhere with its own editor accounts, printed procedures and alternate channels for essential transactions.
• Service-by-service recovery targets. Engineers know which services come back first, and the dependent agencies have agreed the order.
• A deadline map. Counsel has identified who can extend each legal deadline and how an extension is published.
• A rehearsed communications plan. Spokespeople, cadence, leak assessment and channels are decided and practiced.
• An out-of-band coordination channel. The incident team can talk without using the systems the attacker may be reading.
• Clear attribution rules. The plan says who decides what is said about the attacker, and how that is coordinated with federal partners, elected leaders and insurers.

An inspector general or legislative auditor reviewing that preparation would want to see the artifacts behind each line: the exercise reports and the fixes they produced, the approved status-page templates, the deadline map, and patch timelines for internet-facing systems. Agencies that can produce those documents in an afternoon are usually the ones that can execute the plan.

Unprepared governments repeat the same errors. Consolidated platforms are built with no plan for their failure. Status updates are posted on the very portal that is down. Agencies go silent for days while investigating, letting the attacker set the narrative. Leaked documents are taken at face value or ignored. Officials name a culprit early and have to retract. And backups are restored without checking whether the intruder was already present when they were made.

What residents see, who speaks and how backups are checked

Five questions test whether an agency has done the work above.

• If our main portal and login system were down for a week, what could residents still see and do?
• Who speaks for us in a politically motivated attack, how often, and through which channels?
• How would we check whether leaked documents are genuine, altered or fabricated, and who would be notified?
• Who decides what we say about an attacker’s identity, and how do we coordinate with federal partners and elected officials?
• How would we confirm that our backups predate any intrusion?

With hindsight

Albania restored its services with allied help and strengthened its defenses, though it continued to report Iran-linked attacks in the following years. A single response, however vigorous, did not end the campaign; it changed how the country prepared for the next one.

Later in September 2022, the FBI and CISA published a joint advisory describing the attack in detail, including roughly fourteen months of prior access. That figure is worth pausing on. The attackers had been inside for more than a year before the visible outage, which is why rebuilding, rather than simply restoring, was part of the job.

The advisory also confirmed the shape of the intrusion. Entry came through a long-patched SharePoint flaw on an internet-facing server. The attackers then compromised the email system, moved large volumes of mail out, and used the VPN with stolen accounts in the final months. Its recommended defenses were familiar: patch known exploited flaws first, watch for large transfers from email servers, and require phishing-resistant multi-factor authentication for all users and VPN connections. None required new technology. Each required discipline over a long period.

The same advisory assessed that the September wave was likely retaliation for the attribution and the diplomatic break. That finding has held up as a general rule for governments weighing public attribution. Naming a state attacker can bring a second round, and the operators of the targeted systems need to be ready before the statement is made.

Iranian state-linked groups stayed active against government and critical infrastructure targets elsewhere. From November 2023, a persona called CyberAv3ngers, which U.S. agencies tied to Iran’s Islamic Revolutionary Guard Corps, compromised internet-exposed industrial controllers made by an Israeli company. A CISA-led advisory counted at least 75 devices compromised by early 2024, at least 34 of them in U.S. water and wastewater systems. Many had default passwords or none. The devices displayed a political message announcing the hack. Control devices are the small industrial computers that run pumps and valves; tampering with them, and then announcing it, follows the same pattern as Albania: the visible effect is the message.

Hack-and-leak operations also reached U.S. politics directly. In August 2024, the FBI, CISA and the Office of the Director of National Intelligence publicly attributed the theft of material from a presidential campaign to Iran. The Justice Department indicted three Iranians associated with the Revolutionary Guard the following month. The pattern was the one HomeLand Justice used: steal documents, then try to control the story by releasing them.

Coordinated public attribution among allies became more common, usually through joint advisories. For state and local agencies, that reinforced the case for leaving attribution to federal authorities and focusing their own energy on service, communication and recovery.

Many U.S. states built or formalized cyber response capabilities through their National Guard and fusion centers, supported by federal grants. That gave agencies more help to call on, provided they had worked out in advance how to ask for it.

What did not hold up was the hope that diplomatic and financial pressure alone would deter this kind of activity. Sanctions and a broken relationship did not stop further attacks on Albania or Iranian operations elsewhere. They raised the cost and made the attribution public, which mattered, but defense still depended on the targeted organizations.

By 2026, the core point from Albania holds: as services consolidate onto public platforms, those platforms become political targets, and agencies need plans for visible service, public narrative and attribution as well as technical recovery. Consolidation remains the right direction. It simply has to come with a plan for the day the front door is shut.