Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
First VPN
AI-generated illustration
OrganisationUA

First VPN

VPN service sold to cybercriminals, dismantled by French and Dutch police in May 2026.

First VPN went dark on 19-20 May 2026 when French and Dutch investigators, backed by Europol and Eurojust, dismantled its 33 servers in Operation Saffron after quietly copying its user database, leaving 506 customers notified that police knew who they were.

Last refreshed: 12 October 2026 · Appears in 1 active topic

Key Question

What did police learn from First VPN before switching it off?

Timeline for First VPN

#14 30 Sept

Mentioned in: Police seize KillSec ransomware leak site

Cybersecurity: Threats and Defences
#6 21 May

Shut down after 33 servers were seized by Europol across 27 countries

Cybersecurity: Threats and Defences: Saffron raid takes down First VPN
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

First VPN sold anonymous connections to criminals through adverts on Russian-speaking cybercrime forums, taking anonymous payment and running infrastructure built for that market. Europol said the service had featured in almost every major cybercrime investigation it had supported in recent years.

The investigation opened in December 2021, and France and the Netherlands set up a joint investigation team in November 2023. During the action days of 19 and 20 May 2026 the two countries' police took 33 servers offline and seized the 1vpns.com, 1vpns.net and 1vpns.org domains with their onion mirrors, while Ukraine's SBU and National Police searched the administrator's home and interviewed him. Investigators had been inside the service before shutting it: Europol reported 83 intelligence packages, details on 506 users shared with partner forces and leads in 21 investigations, ransomware among them. Europol and Eurojust named no ransomware groups; Help Net Security linked some cases to the Phobos operation.

Operation Saffron belongs to a 2026 run of European actions against infrastructure that many criminal groups share. Four months later Hamburg police led Operation KillSwitch, which took over the KillSec gang's leak site on 30 September.

Common Questions
What happened to First VPN in Operation Saffron?
On 19 and 20 May 2026 French and Dutch authorities, supported by Europol and Eurojust, dismantled 33 servers, seized the 1vpns domains and searched and interviewed the administrator in Ukraine.Source: Europol / Eurojust / Dutch police
Which ransomware groups used First VPN?
Europol and Eurojust did not name the groups. Europol said the intelligence produced leads on ransomware attacks, and Help Net Security reported cases linked to the Phobos ransomware operation.Source: Europol / Help Net Security
Does taking down First VPN reduce ransomware attacks?
Law enforcement takedowns of services like First VPN disrupt operational convenience but do not reduce the supply of ransomware affiliates. In May 2026, the month of the First VPN seizure, BlackFog recorded 95 publicly disclosed ransomware attacks worldwide — a tempo consistent with prior months. Affiliates typically migrate to alternative anonymisation services within days.Source: BlackFog / ENISA
What was First VPN?
A VPN service advertised on Russian-speaking cybercrime forums, offering anonymous payment and infrastructure built for criminal use. Europol said it featured in almost every major cybercrime investigation it had supported in recent years.Source: Europol, 21 May 2026
Were First VPN users identified?
Yes. Investigators obtained the user database before the shutdown, shared information on 506 users internationally and notified every user that they had been identified.Source: Europol, 21 May 2026
Source Material
Operation Saffron: Europol dismantles First VPN used by 25 ransomware gangs

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 12 October 2026. Editorial standards.