Europol Dismantles Illegal Streaming: 29 Arrests Worldwide
Europol has announced the results of a major international operation targeting organized criminal networks behind illegal streaming services, resulting in 29 arrests and the dismantling of nine organized crime groups across 13 countries. The seven-month operation, codenamed KRATOS 2, ran from September 2025 to April 2026 and was coordinated by Bulgaria’s General Directorate Combating Organised Crime (GDBOP) with support from Europol.
The Scale of the Operation
Law enforcement authorities conducted 148 house searches, identified 86 suspects, and referred 59 cases to judicial authorities, with 72 ongoing criminal investigations still in progress. The operation resulted in the removal of over 27,000 illegal streaming URLs and the reporting of 169 domains. Investigators also identified 722,961 infringing objects linked to the criminal networks.
Private sector partners, including AAPA, ACE/MPA, LALIGA, UEFA, Friend MTS, beIN Media Group, and Irdeto, provided critical intelligence that helped authorities identify an additional 4,370 new domains linked to piracy activities, 18,331 IP addresses associated with illegal services, and nearly 400,000 URLs flagged for suspension or removal.
A Sophisticated Criminal Ecosystem
Europol’s analysis reveals that illegal streaming operations have evolved far beyond simple website operations. As the agency stated, “What appears to consumers as cheap access to premium content is powered by complex criminal enterprises.” The groups behind these services increasingly rely on sophisticated technical infrastructure, separating customer-facing websites from the servers hosting illegal content and distributing services across multiple countries to avoid detection.
Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem. According to Europol, this approach “enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.”
The Cybersecurity Threat to Consumers
A critical finding from Operation KRATOS 2 is the convergence of copyright crime and cybercrime. Europol explicitly warned that users of illegal streaming services expose themselves to significant cybersecurity risks, including malware infections, spyware, data theft, and other forms of online exploitation. The same infrastructure used to deliver pirated content can be repurposed for malicious software distribution, making this not merely an intellectual property issue but a public cybersecurity threat.
International Cooperation in Action
The operation involved law enforcement authorities from 13 countries: Belgium, Bulgaria, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the United Kingdom, and the United States. Europol co-led the operational coordination, facilitating intelligence exchange through its Secure Information Exchange Network Application (SIENA) and providing operational and technical support to national authorities.
The Growing Economic Impact
The scale of the operation reflects the massive scope of the illegal streaming economy. In Germany alone, a May 2026 report by Vaunet, the German private broadcasters’ association, found that 7.7 million people used illegal TV streams in 2025 — a 40% increase from 5.5 million in 2022/23. The total economic damage in Germany was estimated at €2.4 billion annually, including €1.5 billion in direct damages to media companies and €542 million in lost taxes and social security contributions.
Frank Giersberg, Vaunet’s Managing Director, commented: “The figures show that TV piracy remains a widespread phenomenon with a significant impact on media providers, media diversity, and the public purse. Therefore, more effective instruments are urgently needed to sustainably curb illegal TV use and thus protect media diversity.”
From KRATOS 1 to KRATOS 2
Operation KRATOS 2 builds on the original Operation KRATOS conducted in 2024, which targeted illegal sports streaming during UEFA EURO 2024 and the Paris Olympic Games. That earlier operation involved 15 countries, resulted in 11 arrests, the seizure of 29 servers and 270 IPTV devices, and the closure of 100 domains. It also identified more than 560 resellers of pirated content and reached over 22 million users worldwide. Drugs, weapons, €1.6 million in cryptocurrency, and €40,000 in cash were also seized during that operation.
The escalation from 11 to 29 arrests and from 100 to over 27,000 URLs removed demonstrates a significant ramp-up in enforcement capacity and the growing scale of the problem.
What This Means Going Forward
Operation KRATOS 2 represents a significant shift in law enforcement’s approach to digital piracy. By targeting the entire criminal ecosystem — the technical infrastructure, financial flows, and organized crime groups — rather than simply taking down websites in a “whack-a-mole” fashion, authorities are adopting a more sustainable strategy.
Europol has designated intellectual property crime as a priority area, with the European Financial and Economic Crime Centre (EFECC) supporting operations. The convergence of copyright crime with broader cybercrime threats suggests that illegal streaming enforcement will remain a recurring priority in Europol’s enforcement calendar, with takedown scale likely to continue increasing with each successive operation.