Albania’s Official National Teacher Training Portal Data Breach

Albania’s Official National Teacher Training Portal, identified by the domain arsimi[.]gov[.]al, was listed as a victim on the Emperador ransomware group’s dark web portal on August 17, 2026. This portal serves as the national infrastructure for teacher professional development, certification, and school management within Albania, operating under the Ministry of Education and impacting tens of thousands of educators and administrative staff. The targeting of such a critical national educational resource raises significant concerns about the potential compromise of sensitive data and disruption of essential services for educators across the country. Emperador’s activity appears focused on public sector entities, with the listing of Albania’s National Teacher Training Portal following a similar claim against the City Government of Baguio in the Philippines within the preceding 60 days. This pattern suggests a deliberate targeting strategy rather than opportunistic attacks, with the group demonstrating interest in both the Education and Government & Defense sectors. The limited number of publicly claimed victims in recent periods indicates a potentially focused and strategic approach by Emperador to select high-impact targets.

SOCRadar telemetry identified 25 records associated with arsimi[.]gov[.]al. Six of these records were classified as employee credentials on organization systems: two credentials targeting Microsoft Entra ID (login.microsoftonline[.]com) and four additional credentials found on the Single Sign-On (SSO) provider (arsimi[.]gov[.]al/prod/ssoprovider), internal management systems (smia.arsimi[.]gov[.]al, shkolla.arsimi[.]gov[.]al), and the teacher-training portal itself (ualbania.arsimi[.]gov[.]al). Furthermore, thirteen external-user credentials were also found on the same target-owned systems. Log dates for these credentials span from July 17 to August 14, 2026. Notably, one record had an insert date of December 2024 alongside an August 2026 log date, indicating a potential persistence gap of 20 months where credentials may have been exposed without rotation on national education infrastructure. The compromise of Entra ID and the SSO provider at this scale presents a significant risk, potentially granting direct lateral movement access across Albania’s entire national education digital infrastructure. The freshness of the Entra ID and SSO provider logs, extending to August 14, 2026, just three days before the portal’s listing date, suggests active credential harvesting occurred within the likely window of the ransomware incident. This raises critical concerns about the security posture of the organization. It is highly recommended that forced password resets and multi-factor authentication enforcement for all @arsimi.gov.al accounts be implemented immediately, with a priority on Entra ID and SSO provider accounts. Additionally, auditing authentication events across all affected subdomains from July 2026 onward is crucial for identifying the full scope of any potential compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.