Cybercriminal VPN Taken Offline

Authorities have dismantled First VPN, a virtual private network service allegedly used by ransomware groups and other cybercriminals to conceal attacks, fraud and data theft. The international operation was led by France and the Netherlands with support from Europol and Eurojust, and took place between May 19 and 20, 2026.

Investigators interviewed the service’s administrator and conducted a house search in Ukraine while dismantling 33 servers linked to the operation. Authorities also seized the domains 1vpns.com, 1vpns.net and 1vpns.org, along with associated onion addresses. Users of the service were notified that it had been shut down and identified by investigators.

The investigation began in December 2021 and provided authorities with access to the service’s user database and records of VPN connections. Europol said the intelligence identified thousands of users linked to ransomware attacks, fraud schemes and other criminal activity. Cybersecurity company Bitdefender supported the investigation by providing technical assistance through Europol.

Europol reported that 83 intelligence packages have been shared, information on 506 users has been distributed internationally and 21 Europol-supported investigations have advanced as a result. Authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine and the United Kingdom participated in the operation, while agencies from additional countries supported the analysis and international coordination of the seized data.