The sensational data breach case in Albania, which has seen almost a quarter of the country’s population having their personal details stolen, is still undergoing investigation.

Tirana’s Prosecutor General, Elisabeta Imeraj, spoke at a press conference on January 7, giving the public details of the disregard for the rules by certain tax administration employees, which led to the huge personal data breach.

The stolen data contained confidential information from identity cards, people’s places of work and salary details, as well as car number registrations and other highly personal information.

The Albanian public first became aware of this incident on December 22 last year. However, it has been discovered the data breach had been going on for several months, even as far back as early 2020.

During the official investigations, four suspects have emerged. The first two – Eni Qirjako and Andi Agaraj – were employees of the tax office and recognised information technology specialists who now stand allegedly responsible for stealing the data. The other two, Klodian Sota and Endri Ikonomi, have been described as private collectors, they too being suspected of illegally acquiring the data. All four were reportedly apprehended, three of them being placed under house arrest.

Endri Ikonomi had previously worked for Credit 2 All, which prompted some media to suggest that the company was connected with the theft. However, subsequent inquiries found out that in 2020, Ikonomi had set up the PRO 3 VT company, its main activity being microlending for individuals. It is alleged that Ikonomi bought citizens’ personal data specifically for PRO 3 VT. That the data theft began almost immediately after its foundation has placed Ikonomi under wide suspicion. He has confirmed that he did buy the data for his business but claims he did not know the source of the information obtained.

Vlado Cvetkosvki, the current administrator of Credit 2 Аll, said that his company is engaged in consulting services for legal entities and has nothing to do with the storage or processing of personal data of individuals.

Mr. Cvetkosvki also provided information that Ikonomi had also worked as a private collector and had founded his own business, now associated with the data leakage.

"The illegal activities of Endri Ikonomi have nothing to do with us, and any direct or indirect allegation related to the legitimate activities of the company are groundless. Credit 2 All always adheres to the most honest and legal working methods and constantly values its clients," said Mr Cvetkosvki.

He has assured that Credit 2 All would provide every assistance to law enforcement agencies investigating the incident if they were to contact the company.

In addition, Mr Cvetkosvki has pledged that Credit 2 All will be carrying out its own internal audit to ensure the company’s safety and to put the public’s and their client’s minds at rest.