Law enforcement agencies have announced the disruption of nearly 11,000 cybercriminal networks and the arrest of more than 1,400 people in Operation Serengeti III, according to the reported details of the international operation. The action reportedly targeted business email compromise, ransomware and online scams.

While the operation took place in Africa, the underlying threats are highly relevant to European companies because the cybercrime methods involved are routinely used against businesses across borders. For SMEs, e-commerce firms and digital teams, the news is less about geography and more about the continuing scale and organisation of financially motivated cybercrime.

What happened

According to the report, authorities disrupted close to 11,000 cybercrime networks and made more than 1,400 arrests as part of Operation Serengeti III. The operation reportedly focused on several categories of cyber-enabled crime that frequently affect businesses, including:

• Business email compromise (BEC), where attackers impersonate executives, suppliers or partners to redirect payments or steal sensitive information.
• Ransomware, where attackers encrypt systems or steal data in order to demand payment.
• Online scams, which can include fraud campaigns targeting companies, staff and customers.

The announcement shows continued law enforcement coordination against international cybercrime activity. However, disruption actions do not mean these threats have disappeared. Similar groups, tools and tactics often reappear elsewhere or shift to new infrastructure.

Why it matters for European businesses

European companies are frequent targets of the same attack types mentioned in the operation. Business email compromise in particular remains one of the most practical and costly risks for SMEs because it does not always require malware or complex intrusion. In many cases, attackers exploit weak payment approval processes, compromised email accounts or convincing social engineering.

Ransomware also remains a material operational risk. Even when an organisation is not directly targeted with encryption, extortion can involve data theft, service disruption or pressure on suppliers and partners. For businesses with cross-border vendors, remote teams or cloud-based workflows, these risks are amplified by reliance on email, SaaS platforms and digital payment processes.

The broader business message is that cybercrime is industrialised and international. A successful police operation is positive, but it does not reduce the need for routine defensive controls in European organisations.

Who may be affected

• SMEs that rely heavily on email for invoices, supplier communication and approvals.
• E-commerce businesses handling customer accounts, online payments and third-party logistics relationships.
• Finance and operations teams that process bank detail changes, urgent transfer requests or procurement communications.
• IT and security teams responsible for email security, endpoint protection, identity controls and backups.
• Companies with international suppliers or distributed workforces, where impersonation and verification gaps can be easier to exploit.

What companies should consider

• Review payment verification procedures: Require out-of-band confirmation for bank account changes, invoice redirections and urgent payment requests.
• Strengthen email account security: Use multi-factor authentication, monitor suspicious login activity and reduce the risk of mailbox compromise.
• Train staff on BEC and phishing: Focus on practical scenarios such as fake executive requests, supplier impersonation and fraudulent invoice changes.
• Check ransomware readiness: Maintain tested backups, patch internet-facing systems and ensure endpoint and identity protections are in place.
• Update incident response processes: Make sure finance, IT and leadership teams know how to respond quickly to suspected fraud, account compromise or extortion activity.
• Assess supplier exposure: Review whether key vendors and partners could become a route for fraud, impersonation or data compromise.

For European business leaders, the main takeaway is practical: international enforcement can disrupt criminal infrastructure, but companies should assume that BEC, ransomware and online fraud attempts will continue. Basic controls around identity, payments, staff awareness and recovery planning remain essential.