First VPN takedown by Europol and French-Dutch authorities
Law Enforcement
Summary
Hide ▲
Show ▼
Europol and French and Dutch authorities took First VPN offline in a cross-border operation that also seized servers and arrested the administrator. The case matters because the service was used in ransomware and data theft attacks and was part of cybercrime infrastructure. The action also enabled investigators to collect traffic data and identify users tied to broader cybercrime probes.
Related Happenings
Dutch National Police arrest Ajax hack suspect
Law Enforcement
First: 27.05.2026 12:09
Last: 27.05.2026 12:09
Sources 1
About this happening:
The **Dutch National Police** arrested a **35-year-old man from Buren** in a **computer trespassing** case tied to **Ajax Amsterdam (AFC Ajax)**, escalating a criminal probe into...
Dutch National Police arrest Ajax hack suspect
Law EnforcementAbout this happening: The **Dutch National Police** arrested a **35-year-old man from Buren** in a **computer trespassing** case tied to **Ajax Amsterdam (AFC Ajax)**, escalating a criminal probe into...
Guardia di Finanza dismantles CINEMAGOAL piracy network
Law Enforcement
First: 23.05.2026 17:23
Last: 23.05.2026 17:23
Sources 1
About this happening:
Italian authorities **seized** **CINEMAGOAL** servers and dismantled a cross-border **takedown** of a piracy ecosystem that stole streaming authentication codes. The **Tutto Chiar...
Guardia di Finanza dismantles CINEMAGOAL piracy network
Law EnforcementAbout this happening: Italian authorities **seized** **CINEMAGOAL** servers and dismantled a cross-border **takedown** of a piracy ecosystem that stole streaming authentication codes. The **Tutto Chiar...
First VPN Service as criminal VPN infrastructure for ransomware and fraud operators
Threat Actor Meta
First: 22.05.2026 20:35
Last: 22.05.2026 20:35
Sources 1
How related:
First VPN, per Europol, offered services designed specifically for criminal use, allowing anonymous payments and a hidden infrastructure that enabled paying customers to hide their identities when carrying out ransomware attacks, large-scale fraud, and data theft.
About this happening:
**First VPN Service** functioned as a criminal VPN layer that let ransomware, fraud, and data theft operators hide their identities, expanding the reach and resilience of undergro...
First VPN Service as criminal VPN infrastructure for ransomware and fraud operators
Threat Actor MetaHow related: First VPN, per Europol, offered services designed specifically for criminal use, allowing anonymous payments and a hidden infrastructure that enabled paying customers to hide their identities when carrying out ransomware attacks, large-scale fraud, and data theft.
About this happening: **First VPN Service** functioned as a criminal VPN layer that let ransomware, fraud, and data theft operators hide their identities, expanding the reach and resilience of undergro...
First VPN had assets seized in First VPN takedown
Law Enforcement
First: 21.05.2026 18:30
Last: 21.05.2026 18:30
Sources 1
How related:
The international operation took place between May 19 and 20, during which authorities took a series of concurrent actions that involved interviewing the service's administrator, conducting a house search in Ukraine, taking down 33 servers, and seizing infrastructure used to support cybercriminal activity globally.
About this happening:
Authorities **took down First VPN**, a **ransomware**-linked service used to hide cybercrime activity, in a coordinated action led by **France and the Netherlands**. The operation...
First VPN had assets seized in First VPN takedown
Law EnforcementHow related: The international operation took place between May 19 and 20, during which authorities took a series of concurrent actions that involved interviewing the service's administrator, conducting a house search in Ukraine, taking down 33 servers, and seizing infrastructure used to support cybercriminal activity globally.
About this happening: Authorities **took down First VPN**, a **ransomware**-linked service used to hide cybercrime activity, in a coordinated action led by **France and the Netherlands**. The operation...
Austrian-Albanian cryptocurrency fraud ring takedown
Law Enforcement
First: 29.04.2026 17:27
Last: 29.04.2026 17:27
Sources 1
About this happening:
Austrian and Albanian authorities **dismantled** a **cryptocurrency investment fraud ring**, escalating a cross-border cyberfraud case that allegedly caused **over €50 million** i...
Austrian-Albanian cryptocurrency fraud ring takedown
Law EnforcementAbout this happening: Austrian and Albanian authorities **dismantled** a **cryptocurrency investment fraud ring**, escalating a cross-border cyberfraud case that allegedly caused **over €50 million** i...
Timeline
-
21.05.2026 16:09 2 articles · 6d ago
Europol and French-Dutch authorities dismantle First VPN
Initial DisclosureEuropol and French and Dutch authorities took First VPN offline in a joint international law enforcement operation, seizing 33 servers, taking down 1vpns.com, 1vpns.net, 1vpns.org and related onion domains, arresting the administrator, searching a house in Ukraine, and sharing intelligence about 506 users linked to ransomware and data theft activity.
Show sources
- Police seize “First VPN” service used in ransomware, data theft attacks — www.bleepingcomputer.com — 21.05.2026 16:09
- First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups — thehackernews.com — 22.05.2026 20:35