Cybersecurity in the Western Balkans: Institutions race to keep pace with increasingly sophisticated attacks

Cyberattacks are becoming more frequent and increasingly sophisticated, leaving institutions in a race against time and technology. Data are stolen from government servers, companies are set up using stolen information, and attackers demand ransom. Where does the Western Balkans stand amid these threats? Experts from Serbia, North Macedonia and Albania who spoke to Kosovo Online agree on one point: secure online communication requires both advanced technological support and experts who know how to use it. They note that Serbia leads the region in the development of e-government, that the rest of the region is also making progress, but that the main challenge is how to further protect increasingly vulnerable infrastructure.

Written by: Katarina Saicic

In October, Cybersecurity Awareness Month, the question arises as to how prepared Albania, Serbia, North Macedonia and Kosovo are to respond to increasingly complex digital threats, who is responsible for protecting systems and data, and whether the expansion of digital services is being matched by a sufficiently high level of security awareness among institutions, companies and citizens.

The expansion of digital services across the Western Balkans has not been accompanied by an equally consistent development of the capacity needed to protect them. Data from the Organisation for Economic Co-operation and Development (OECD) show that in 2023–2024, an average of 34.8 percent of the region’s population used the internet to interact with public authorities, compared with 63 percent in the European Union. At the same time, a growing number of citizens—around 60 percent—as well as companies use the internet for shopping, business activities and access to public services.

Cyberattacks are no longer merely an IT-sector problem. They can disrupt the functioning of institutions, the availability of public services and business operations, while also compromising the security of citizens’ personal data.

Examples from across the region show that no country is immune to cyber threats. In 2025, Albania recorded 51 cyber incidents affecting critical and important information infrastructure, according to data from Albania’s National Cyber Security Authority. That was 20 more than in 2024. In the first half of 2026, through June, the authority recorded nine cyber incidents and 131 data breaches.

In North Macedonia, attacks on government institutions and the energy sector have highlighted vulnerabilities in the country’s systems. In its 2026 report on the digital transformation of small and medium-sized enterprises, the OECD states that North Macedonia records several hundred cyber incidents annually, with phishing and ransomware attacks against public and private systems on the rise.

One notable incident occurred in September 2024, when a ransomware attack on the Ministry of Economy and Labor disrupted access to email and internet services.

Serbia has a National Center for the Prevention of Security Risks in ICT Systems. This year, Serbia recorded 39 percent more cyberattacks than the previous year. Education was the most frequently targeted sector in 2025, with attacks increasing by 22 percent year on year, followed by public administration, telecommunications and healthcare, according to a bulletin published by NALED. The 2025 Statistical Report on Incidents in ICT Systems by Serbia’s National CERT, which operates within RATEL, also contains noteworthy data. In the banking and financial markets sector alone, 5,404 phishing incidents were recorded.

Slow progress in Kosovo

In Kosovo, digital services, including the e-Kosova portal, have become an important means of communication between citizens and institutions.

According to the European Commission’s 2025 Kosovo Report, around 98.6 percent of households had internet access in 2023, while broadband coverage reached 100 percent. Nevertheless, progress in the digitalization of the public sector was assessed as slow: around 10 percent of public services were fully available online, while most digitalized services primarily provided information. The report also noted that 230 online services were available through the e-Kosova portal.

Digital expert and editor-in-chief of the Netokracija portal Marko Crnjanski told Kosovo Online that Serbia led the Balkans in terms of the development of digital infrastructure and public administration services, but stressed the importance of educating people so that they can recognize the dangers posed by hacking and other online attacks.

Crnjanski said that, when attacks occur, it is essential for a data center to be able to recover quickly and to have backup copies of its data available in case of an emergency.

“When it comes to the Western Balkans and Serbia, I am not entirely sure how many resources and how much qualified personnel we have here to safeguard that data,” Crnjanski said.

He referred to the data center in Kragujevac, noting that it was extensively equipped and stored more than three million data records.

“Any attack on a data storage center poses a risk to citizens as well. But, as I have said, having backup data is the most important thing in such situations so that systems can subsequently resume normal operations,” Crnjanski said.

The digital expert stressed that vast amounts of data were stored on servers and that digital infrastructure in the Balkans was highly developed.

Serbia leads the region

“Serbia is one of the leading countries in the Balkans, particularly when it comes to e-government and other public administration systems. Around 2.5 million people use the e-government system. Serbia is in the lead, followed by Albania and Montenegro. We remember the major cyberattack on the Electric Power Industry of Serbia in 2023, which resulted in a complete system breakdown. The attack came through email and entered EPS’s system that way. The most important thing is to have properly trained employees in these institutions who know how to defend against attacks and repel them,” he said.

Crnjanski explained that phishing attacks were the most common because they could convincingly imitate content that a user, or an employee in a public administration office, might click on believing it to be legitimate.

“So-called phishing attacks have become so sophisticated that they convincingly replicate a particular form of communication to such an extent that a person believes it is something genuinely relevant to them. Once the user clicks on the link, hackers obtain the data. Through phishing attacks, hackers target large institutions in order to obtain vast quantities of citizens’ data, which can later be misused in various ways. For example, someone could establish a company somewhere in Indonesia in your name or gain access to information about your bank account. Attacks can also be carried out through applications such as WhatsApp or other messaging services,” Crnjanski explained.

He added that around 90 percent of people in Serbia had internet access and that younger people were the most digitally literate.

Cybersecurity expert from Skopje Bozidar Spirovski warned in a statement to Kosovo Online that serious vulnerabilities in digital systems were being discovered with increasing frequency worldwide, prompting some banks outside North Macedonia to temporarily shut down their services. He stressed that rapid responses and stronger protection of digital services were essential.

Serious vulnerabilities emerging worldwide

“October is the month when cybersecurity awareness is promoted worldwide. In the past week alone, the cybersecurity world has turned into a real circus. Huge and extremely serious vulnerabilities have been discovered globally, to the point that online services began being shut down last Friday because they were found to be extremely vulnerable. There are two critical vulnerabilities in PHP, a programming language used by a large number of real-world services around the globe. There are literally banks that have shut down services—not here, but outside North Macedonia—until the vulnerabilities are fixed. And it does not stop there,” Spirovski said.

He added that numerous problems were occurring and new system vulnerabilities were being discovered on a daily basis.

“As of this morning, we have new critical vulnerabilities that need to be addressed. The overall cybersecurity situation globally has become extremely tense recently. How does that affect us locally? It depends on the companies and organizations. We have good examples, but also some that are not so good. I want to urge people to keep themselves informed and respond as quickly as possible because developments have begun moving extremely fast. Rapid action is essential,” Spirovski said.

Asked about the level of digitalization in the region and in North Macedonia, Spirovski said that the process was progressing successfully.

“That transformation in North Macedonia is taking place, I would say, gradually and quite successfully, judging by the services I am able to monitor, such as uslugi.gov.mk, electronic banking services and online services offered by other providers, whether telecommunications companies, water utilities or others. We are not doing badly. The process is moving forward, which also raises the question of whether digitalized services are sufficiently well protected. I sincerely hope they are and that all the teams maintaining them are also monitoring the threats that exist,” the expert said.

He noted that younger generations used online services more frequently.

“When it comes to older generations, much depends on whether they are reluctant to embrace digitalization. I would advise people sometimes to consider doing something in person rather than online because there are so many scams. Older people who lack experience are particularly vulnerable and are constantly exposed to attacks and scams telling them, ‘Click here,’ ‘Get this, it’s urgent,’ and similar things. My recommendation is to be cautious. Digitalization is excellent, but you should take your time and exercise caution every time,” Spirovski concluded.

Albania targeted by Iran

Kristian Josifi, an expert with the Cyber Incident Investigation Department at the National Cyber Security Authority, told Kosovo Online that Albania was being targeted by cyberattacks from Iran, but that the relevant authorities remained constantly vigilant.

“The situation in Albania is well known. We are being targeted by cyberattacks from the Iranian state. It is well known that data posted online are always exposed to cyberattacks. Recently, there have been a large number of attempted cyberattacks against these institutions, as well as other institutions. There has also been an increase in smishing and phishing attacks targeting various individuals, including people working at these institutions,” Josifi said.

He added that a positive factor was that the National Cyber Security Authority remained constantly vigilant and operated 24 hours a day, seven days a week, with staff monitoring the situation in shifts.

“We monitor ongoing activities and oversee critical and important infrastructure. The Analysis Directorate then steps in if an incident occurs and the situation escalates, conducting a more detailed assessment to determine whether a cyberattack has taken place. The main reason for increasing vigilance, improving capabilities and training cybersecurity experts was the 2022 attack. That is our point of reference because it was then that we realized just how closely the IT profession is connected to cybersecurity,” he explained.

Speaking about the development of digitalization in Albania, Josifi said that the main system used by citizens and institutions was e-Albania.

“We have made progress in converting physical documents into digital form. Despite the fact that most documentation has been digitized, copies of physical documents have also been retained because one can never know what consequences a potential cyberattack might have. The idea is to keep pace with technological advances. Modernization will come with time, and very soon we will have 100 percent of our documentation in digital systems, as this also makes our lives easier by automating various processes,” Josifi said.

In his view, Albanian society has not yet fully adapted to digitalization.

“The problem is with older people because it is more difficult for them. First, people need to understand how the system works before they can use it. We are trying to make digital systems as accessible and user-friendly as possible so that people can interact with them,” Josifi concluded.