Cyberattacks and Data Breaches Rock Western Balkans and Turkey, Exposing Critical Vulnerabilities A series of cyberattacks and data breaches across the Western Balkans and Turkey in early 2026 have exposed persistent security gaps in both public and private sector infrastructure. Iranian-linked hackers, Russian state-affiliated groups, and criminal actors targeted government institutions, telecom providers, and critical services, compromising sensitive data and disrupting operations. In Albania, the Iranian hacker group Homeland Justice claimed responsibility for attacks on parliament and the Albanian Post in March 2026. The group leaked parliamentary emails and postal service data on Telegram, aiming to delete servers and exfiltrate sensitive information. While authorities described the attack as "sophisticated," they confirmed that core infrastructure remained intact. The incidents follow a pattern of Iranian cyber aggression since 2022, when retaliatory strikes against Albania linked to its hosting of Iranian dissidents led to severed diplomatic ties. Experts criticized systemic negligence, noting that basic security measures remain unimplemented despite repeated breaches. In North Macedonia, cybersecurity researchers identified a compromise of the gov.mk email domain by Fancy Bear, a Russian hacker group tied to military intelligence. While the government denied any official breach, the inclusion of sensitive addresses including those from the Ministry of Defence in the group’s materials suggests targeted espionage. The discovery comes amid heightened tensions, as North Macedonia joined Western sanctions against Russia and provided military aid to Ukraine in 2024. Major data breaches also struck telecom providers in the region. In Serbia, Telekom Srbija suffered a leak affecting over 600,000 users, exposing personal details such as names, addresses, and national identifiers. Attackers attempted extortion, threatening to publish the stolen data. Similarly, Turkey’s Turkcell Superonline reported a breach impacting 300,000 customers, with leaked information including ID numbers and subscription details. Both incidents, detected via dark web monitoring, underscore critical weaknesses in customer data protection, leaving individuals vulnerable to identity theft and financial fraud. In Albania, the risks of such breaches have materialized: state police reported a case where stolen financial data was used to open a fraudulent bank account, enabling unauthorized transactions in Spain. These incidents reflect a broader trend of escalating cyber threats in the region, where attackers exploit systemic vulnerabilities in IT systems, databases, and communication networks. The consequences extend beyond immediate data loss, eroding public trust in institutions and raising national security concerns. Governments and companies face growing pressure to address long-standing security failures that have left citizens exposed.