American Cybersecurity Expert Publishes “Diella” Data! Claims Access to Government System! From Salaries to Voters and Parliamentarians, What the Files Contain

Patrick Quirk, an American cybersecurity and OSINT techniques expert, claims that a considerable portion of the data of the “Diella” minister could be accessed without an authentication process.

According to him, six API endpoints of the Parliament accepted ordinary requests without an API key, bearer token or session cookie, meaning that the system did not verify whether the user was authorized to access it.

Quirk first made this claim in April.

However, the data he says he downloaded was published yesterday, following a response from AKSHI, which stated that the information had been obtained from the system’s interface and not from the system itself.

“Clarification regarding inaccuracies published about Diella’s operation.

In the interest of providing the public with accurate information, AKSHI is clarifying several technical inaccuracies recently published regarding Diella and the way it operates.

The page seen by the user is the system’s interface, not the system itself. When a citizen asks Diella for a document, the request is processed within government infrastructure, where the artificial intelligence system developed by AKSHI in cooperation with Microsoft operates, using OpenAl models on Azure. The page is what is visible; the system that performs the work is behind it,” AKSHI said in its response.

After the response was published on the Agency’s official Instagram page, Quirk also made public the data that, according to him, had been downloaded from the “Diella” minister.

The complete material amounts to 31 GB and contains more than 54,700 files.

The archive reportedly contains more than 30,000 PDFs with parliamentary documents, more than 20,000 images, over 2,500 office documents, as well as structured government data.

According to the published list, the archive includes 910,000 voter records containing names, identification documents, telephone numbers, employers and political affiliations.

It also allegedly contains 637,138 salary records, representing 22% of Albania’s population.

The list also includes a database of 100,000 suspected police officers, along with photographs, identification documents and dates of birth.

Quirk claims that the data of 236 members of Parliament are also accessible, including email addresses, dates of birth and photographs.

Other data listed include more than 30,000 government documents, information about an Iranian cyberattack during 2022-2024, which he says remains active, as well as a complete mapping of the infrastructure.