International cyber operation takes 102 servers offline
Police and prosecutors say they have secured 6.4 million datasets containing stolen information.
There is news on this story (Thursday, 12 November 2026, 19:48): Police secure 6.4 million stolen records
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
An international police operation has taken 102 servers offline that were used by malware networks. Europol says 6.4 million datasets containing victims’ information have been secured and that those affected are being alerted through various services.
The operation is part of Operation Endgame, an international effort targeting the criminal infrastructure behind malware. Europol names Gootloader, CastleRAT and StealC as networks targeted in this phase. According to Europol, the Dutch police and the Public Prosecution Service took part in the operation.
According to Europol, the stolen information includes passwords, access credentials and digital identities. Such data can be traded or used for identity fraud, taking over accounts and gaining access to corporate networks. Europol refers to victims’ data; that does not mean all datasets represent unique individuals or exclusively Dutch victims.
The data is being made available to, among others, Have I Been Pwned, DIVD, CheckjeHack, NoMoreLeaks, Sekoia and the Shadowserver Foundation. These organisations can inform victims and organisations when their data has been found on the seized infrastructure. Europol says the operation is primarily intended to disrupt the criminal infrastructure and warn victims.
The operation builds on earlier phases of Operation Endgame. In June, the Dutch police reported that more than 24 million login credentials had been found during earlier operations on seized servers, originating from 384,000 computer systems and linked to more than 1.5 million services and companies. Those figures relate to an earlier phase. It is not known whether there is any overlap with Thursday’s 6.4 million datasets.
For companies, the risk is not limited to stolen passwords. Reused passwords, unmanaged accounts and access without an additional security layer can provide an entry point to other systems. Taking servers offline can make data harder to access, but does not guarantee that any copies held by criminals will disappear. According to Europol, warning victims is one of the aims of the operation.
Also show where in Europe and in the world
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The new operation, the number of servers, the 6.4 million datasets and the malware families involved are taken from Europol. Contextual figures from June are dated separately and have not been combined with the new count.
- confirmed In the new phase, 102 servers were taken offline. — Reported by Europol. source
- confirmed 6.4 million victim datasets were secured. — Reported by Europol. source
- confirmed The Dutch police and the Public Prosecution Service took part in the operation. — Mentioned in Europol’s statement. source
- confirmed Earlier Dutch operations found more than 24 million login credentials. — Reported by the Dutch police in June 2026. source
Editor's note
The figures for the new operation come from Europol’s press release. The broader context comes from an earlier publication by the Dutch police; those figures were explicitly not presented as part of the new 6.4 million datasets.Sources
The story so far
- Thursday, 12 November 2026, 15:25 International cyber operation takes 102 servers offline (this article)
- Thursday, 12 November 2026, 19:48 Police secure 6.4 million stolen records
More on this in Dutch media
- Het Parool — „cybercrime malware”
- NRC — „cybercrime malware”
- Tweakers — „cybercrime malware”