European law enforcement agencies have dismantled First VPN, a widely used virtual private network service that enabled cybercriminals to hide their identities and infrastructure. Promoted on Russian-speaking cybercrime forums, the service was a fixture in ransomware, fraud, and data theft operations, according to Europol. The takedown, led by France and the Netherlands with support from Europol, Eurojust, and eight other countries, unfolded over two days and resulted in the arrest of the alleged administrator in Ukraine.

Investigators seized 33 servers and multiple domains, including 1vpns.com, 1vpns.net, and 1vpns.org. They also obtained the service’s user database, identifying thousands of connections tied to cybercrime. Authorities say the intelligence gathered will support 21 ongoing investigations globally, including those focused on ransomware and fraud.

First VPN users were notified of the shutdown and warned their identities are now exposed. The operation marks a significant disruption to a tool that, for years, was considered a reliable shield by cybercriminals. French and Dutch investigators began their work in November 2023, coordinating evidence sharing with 16 countries to amplify the impact.