Back Securityaffairs.Co

Global law enforcement operation takes First VPN offline

Securityaffairs.Co •Pierluigi Paganini • May 21, 2026

Police seized First VPN in a global crackdown, exposed its cybercrime users, and shut down infrastructure tied to ransomware and data theft. A major international law enforcement operation has taken First VPN offline, a service that had become a quiet staple for ransomware crews, data thieves, and other cybercriminals trying to hide in plain sight. “The coordinated […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation Saffron: First VPN Dismantled in Major Cybercrime Takedown On May 19-20, 2026, an international law enforcement operation, dubbed Operation Saffron, successfully dismantled First VPN, a virtual private network service heavily utilized by cybercriminals for ransomware, fraud, and data theft. Led by French and Dutch authorities, with support from Europol and Eurojust, the operation resulted in the seizure of 33 servers and the arrest of the service's administrator in Ukraine. First VPN was known for providing anonymity to its users, facilitating illicit activities by masking their identities and infrastructure. The investigation, which began in December 2021, revealed that First VPN had been involved in nearly every major cybercrime investigation supported by Europol in recent years. Authorities identified and notified 506 users linked to cybercriminal activities, disseminating 83 intelligence packages to aid ongoing investigations. This operation marks a significant milestone in the fight against cybercrime, showcasing the effectiveness of international collaboration. 22 sources 77

Global law enforcement operation takes First VPN offline

The full story

Extracted Entities

Attack Types (2)

Platforms (1)