Operation Saffron, how a VPN used by 25 ransomware gangs was taken down

The article on VPNs pointed out that using a VPN shifts trust onto its provider, without eliminating it. Operation Saffron, carried out in May 2026, shows what happens when that trust is placed in a provider built from the ground up to serve criminals rather than protect legitimate privacy.

What happened

On May 19 and 20, 2026, an international operation led by French and Dutch authorities, with support from Europol and Eurojust, took down First VPN, a service active since 2014. Authorities seized 33 servers spread across 27 countries, took down several associated domains, including .onion addresses reachable through Tor (see the dedicated article), and arrested the service's administrator in Ukraine. At least 25 ransomware groups, including Avaddon and Phobos, were among the service's identified users.

A "bulletproof VPN," built specifically for crime

First VPN wasn't a mainstream VPN provider that had accidentally attracted a criminal clientele: this kind of service, sometimes called "bulletproof" hosting, is built and marketed specifically to ignore abuse reports and withstand legal pressure, with organized criminal groups as its intended customers rather than privacy-conscious individuals. That's a difference in kind, not just degree, from a provider like Mullvad, whose cooperation during a real raid in 2023 had shown exactly the opposite: nothing to hide, for lack of ever having collected the requested data.

Why this doesn't call legitimate VPNs into question

This incident does nothing to undermine the value of a VPN for legitimate use, already explained in the dedicated article: instead, it shows just how much choosing the right provider, already presented as decisive, really is. The same signals already recommended for spotting a serious provider (published independent audits, a verifiable no-logging policy, a transparent track record against a real legal request) are precisely what First VPN entirely lacked.

What being able to "read the traffic" reveals

The most telling detail of this operation lies in its technical consequence: once the servers were seized, authorities were able to identify 506 users of the service. A genuine no-logs VPN provider, as Mullvad claims to be and as an independent audit can verify, technically has nothing left to seize in a situation like this. The fact that seizing First VPN's servers identified so many users suggests that this service's promise of anonymity was, itself, nothing more than a marketing claim, with no real technical architecture behind it once put to the test.

What this actually changes

This operation confirms, through the reverse example, the same lesson already drawn from the Mullvad incident: a VPN's promise is only as good as the real technical architecture behind it, never just the marketing copy displayed on a sales page. A provider that can't prove, through an independent audit or a real case put to the test, that it genuinely collects nothing deserves no more trust than a service whose goal, from the start, was something else entirely besides protecting its users' privacy.