INTERPOL has announced the results of a large international cybercrime operation that, according to the organisation, disrupted 10,909 malicious networks, led to 1,462 arrests and recovered more than $105 million in illicit funds. The operation, called Operation Serengeti III, took place between 29 June and 31 August 2026 and involved law enforcement agencies from 21 countries.

While the announcement is primarily a law enforcement update, it is also relevant for businesses across Europe. It shows the scale and persistence of cybercrime infrastructure used for fraud, financial theft and other attacks that can affect company networks, websites, cloud systems and payment processes.

What happened

According to INTERPOL, the coordinated operation targeted cybercrime activity across participating jurisdictions and resulted in large-scale disruption of malicious networks. The organisation said authorities also recovered more than $105 million in illicit funds and arrested 1,462 suspects.

Based on the information published so far, the announcement confirms the broad outcome of the operation, but businesses should treat it as a high-level law enforcement summary rather than a complete technical breakdown of the threats involved. It does not mean the underlying cybercrime risk has disappeared, nor does it suggest that all affected criminal groups have been dismantled permanently.

Why it matters for European businesses

For European companies, the main significance is practical rather than political. Large international operations can temporarily disrupt criminal infrastructure, but they also highlight how industrialised cybercrime has become. Businesses are still exposed to attacks that rely on phishing, compromised credentials, business email compromise, malware, ransomware and payment fraud.

The recovery of illicit funds is also a reminder that financial cybercrime remains a major business risk. Small and medium-sized businesses are often targeted because they may have fewer internal controls, leaner IT teams and less mature incident response processes than larger enterprises.

European firms should also note that cybercrime increasingly affects more than internal IT. It can disrupt e-commerce operations, digital marketing accounts, customer communications, SaaS platforms, domain management and supplier relationships. Even when a company is not directly attacked, it may face downstream risk through a compromised vendor, agency, hosting provider or cloud environment.

Who may be affected

• SMEs and founders that rely on email, online banking and cloud tools without dedicated security staff.
• E-commerce businesses handling payments, customer accounts and order workflows that are attractive targets for fraud and account compromise.
• Marketing and digital teams using ad platforms, CMS tools, analytics systems and social accounts that can be hijacked or abused.
• IT teams and managed service providers responsible for endpoint security, identity management, backups and monitoring.
• Companies in regulated sectors that face additional expectations around incident handling, resilience and data protection.

What companies should consider

Although the INTERPOL announcement is not a new regulation or product change, it supports several practical security priorities for European businesses:

• Review phishing and payment fraud controls. Verify approval steps for bank detail changes, invoice payments and urgent financial requests.
• Strengthen identity security. Use multi-factor authentication across email, admin panels, cloud services and business-critical SaaS platforms.
• Audit privileged access. Remove unused accounts, limit administrator rights and review third-party access from agencies, contractors and vendors.
• Improve monitoring and response. Make sure suspicious login activity, endpoint alerts and unusual payment events are reviewed quickly.
• Check backup and recovery readiness. Test whether essential systems, websites and files can be restored in the event of ransomware or destructive malware.
• Train staff on current attack patterns. Employees in finance, customer support, operations and marketing are common targets for impersonation and credential theft.
• Assess supply-chain exposure. Ask key providers about their incident response, authentication controls and breach notification processes.

For many businesses, the immediate takeaway is simple: international takedowns can reduce some criminal activity, but they do not remove the need for everyday cyber hygiene. European organisations should continue treating credential security, payment verification, backup resilience and vendor risk management as board-level operational issues, not just technical tasks.