A cyberattack targeting the emails of three special prosecutors—Behar Dibra, Enkeleida Millonai, and Elida Kaçkini—on March 12th, 2025, has sent shockwaves through Albania’s Special Anti-Corruption Structure (SPAK). The institution, however, only provided details three weeks later, following media reports exposing the incident. Despite the delay in official communication, SPAK assured the public that immediate security measures were taken and that no investigative files or internal IT systems were compromised.
Following an intensive investigation, authorities arrested two former officials—Arnold Rrokaj, a former employee of the Municipal Police (IMT), and Zambak Gjonaj, a former prison official in Vlora. The Special Prosecution suspects that a structured criminal group orchestrated the cyberattack. However, despite these arrests, neither SPAK nor the authorities have disclosed specific details about the suspects’ role in the hacking operation, local media reports.
Breach Details and Official Response
According to SPAK, while hackers failed to infiltrate the institution's internal IT system, they successfully gained access to email accounts of multiple prosecutors. However, SPAK strongly denies that any case files were leaked. The cyberattackers also attempted to breach the email of SPAK's Chief Prosecutor, Altin Dumani, but were unsuccessful due to strong security measures.
A statement from SPAK reads:
"Our investigations revealed that only certain email addresses were compromised, but the general IT system of the institution remains intact. The individuals responsible managed to obtain some information but could not access investigative files. Additionally, they attempted to breach the email of the Head of the Special Prosecution Office, Mr. Altin Dumani, but failed."
Following the cyberattack, SPAK conducted an internal administrative review and strengthened security protocols to prevent similar incidents in the future.
Arrests and Suspected Information Leak
Within 24 hours of detecting the breach, authorities apprehended Arnold Rrokaj and Zambak Gjonaj. During their arrests, investigators seized electronic devices used in the hacking operation, along with downloaded files.
Sources from Shqiptarja.com indicate that the stolen documents were distributed to third parties, including two journalists, former Prison Director Agim Ismaili, and Dritan Palnikaj, the current Secretary-General of the Ministry of Education. In response, the lead prosecutor of the case, Bledar Maksuti, issued an order prohibiting the publication of any stolen materials.
Authorities have also questioned several other individuals believed to have received or handled the compromised information.
Ongoing Investigations and Potential Criminal Network
While SPAK insists that no internal personnel were involved in the breach, the investigation remains ongoing. Authorities suspect that the cyberattack was part of a broader operation carried out by a structured criminal group seeking access to sensitive legal information.
Despite the alarming nature of the attack, SPAK has reassured the public that the institution’s data integrity remains protected, and all necessary cybersecurity reinforcements have been implemented to prevent future incidents.
This cyberattack highlights growing concerns about cybersecurity vulnerabilities in Albania’s judicial system, as well as the increasing involvement of criminal groups in digital espionage. The case remains under investigation, with more developments expected in the coming weeks.