Albanian Parliament cyberattack deletes 183 virtual machines and disrupts staff VDI

On 10 March 2026, attackers compromised the Parliament of Albania through VPN access using credentials belonging to an unnamed third-party service provider. After lateral movement into the virtual infrastructure, the attackers deleted 183 virtual machines in the VDI environment, deleted a significant amount of user file-share data and exfiltrated a portion of the compromised information. Parliament staff lost access to the VDI environment, which Albania's National Cyber Security Authority described as a key component of daily end-user operations, and AKSK classified the incident as having significant operational impact. Core critical servers, official email and public-facing services remained functional. Homeland Justice claimed responsibility, and AKSK assessed the activity as matching Iranian state-linked operations.