Authorities Seize First VPN Service Linked to Ransomware Attacks

European authorities led by France and the Netherlands, supported by Eurojust and Europol, dismantled a major criminal VPN service (First VPN) on 19–20 May 2026, seizing 33+ servers across 27 countries, multiple domains (including 1vpns.com/.net/.org and Tor onion domains), and collecting live traffic resulting in 83 intelligence packages that identified 506 users; the operation involved a Joint Investigation Team, MLA/EIO processes across 16 countries, and notifications to affected jurisdictions, and is expected to disrupt ransomware and other anonymized criminal activity while prompting threat actors to migrate to alternate services.