Dutch Police Seize 800 Servers, Arrest Two in Takedown of Hosting Firm Enabling Cyberattacks
Dutch financial crime investigators arrested two men and seized 800 servers belonging to a web hosting company that facilitated cyberattacks, interference operations, and disinformation campaigns.
Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns. The takedown, announced on May 22, 2026, targeted infrastructure used by threat actors for malicious activities, marking one of the largest law enforcement actions against a hosting provider enabling cybercrime.
The operation focused on a hosting firm that knowingly provided services to cybercriminals, allowing them to launch attacks, spread disinformation, and conduct interference operations. The FIOD seized 800 servers as part of the investigation, disrupting the infrastructure that supported these malicious activities. The two arrested individuals are suspected of managing the hosting company and facilitating the criminal operations.
The seized servers were used to host command-and-control infrastructure, phishing sites, and disinformation platforms, according to investigators. The hosting company allegedly ignored warnings about the malicious use of its services, continuing to provide resources to threat actors. The takedown is part of a broader effort by Dutch authorities to combat cybercrime and hold enablers accountable.
The FIOD worked with international partners, including Europol and the FBI, to coordinate the operation. The investigation revealed that the hosting company had been under surveillance for months, with authorities gathering evidence of its involvement in cyberattacks targeting governments, businesses, and individuals. The arrests and server seizures are expected to significantly disrupt the operations of multiple cybercriminal groups.
The takedown highlights the growing focus on hosting providers and other intermediaries that enable cybercrime. Law enforcement agencies worldwide are increasingly targeting the infrastructure that supports malicious activities, rather than just the attackers themselves. This approach aims to make it harder for cybercriminals to operate by cutting off their access to critical resources.
The two arrested individuals face charges related to money laundering, computer intrusion, and facilitating organized crime. They are expected to appear in court in the coming weeks. The FIOD has not disclosed the name of the hosting company, citing the ongoing investigation.
This operation underscores the importance of holding enablers accountable in the fight against cybercrime. By targeting the infrastructure that supports malicious activities, law enforcement can disrupt entire ecosystems of cybercriminal operations. The seizure of 800 servers represents a significant blow to the hosting provider's operations and sends a clear message to other companies that facilitate cyberattacks.