France and Netherlands shut down First VPN, seize 33 servers

A coordinated operation led by France and the Netherlands has dismantled a VPN service, known as First VPN, used by cybercriminals including ransomware operators and fraudsters. The crackdown, supported by Europol, succeeded in taking down 33 servers and seizing three domains over May 19-20, 2026. This service, marketed on Russian-language forums, provided anonymity to users engaging in illicit activities.

Investigators accessed the user database which has already aided 21 ongoing investigations and produced valuable intelligence on over 500 users linked to cybercrimes. The operation underlines the importance of disrupting such services not only for immediate action but also for future investigations.