France and the Netherlands lead the dismantling of First VPN, a service popular among cybercriminals

Coordinated by Europol, the operation led to the seizure of 33 servers, the arrest of the main administrator, and the identification of thousands of users.

Europol announced, on May 21, 2026, that it had coordinated an international operation involving 18 countries, led by France and the Netherlands, which resulted in the dismantling of First VPN. This VPN service was widely used by cybercriminals to conceal their identity and infrastructure. According to Europol, the service was notably used to issue ransom demands, carry out “large-scale fraud,” steal data, and commit “other serious offences.”

“First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major investigation conducted by Europol in recent years,” the agency’s press release stated. Carried out on May 19 and 20, the operation led to the seizure of 33 servers and several domain names. Ukrainian police, supported by French investigators from the cybercrime unit (BL2C), arrested the service’s main administrator.

Opened in December 2021 with the support of cybersecurity firm Bitdefender, the investigation made it possible to recover the entirety of First VPN’s database and identify thousands of users. The analysis of this information, conducted notably by a Franco-Dutch task force established in November 2023, has already contributed to the advancement of 21 investigations supported by Europol.