A seven-month operation led by Bulgaria and coordinated with Europol has dismantled nine organised crime groups that ran illegal IPTV and sports-streaming services. Arrests are the headline, but the operation also shows something useful for anyone who runs hosting, CDN or streaming infrastructure: enforcement now works at the scale of domains, IP addresses and URLs, and providers are part of that pipeline.
What happened
Europol announced the results of Operation KRATOS 2 on 3 June 2026. The operation ran from September 2025 to April 2026. It was led by Bulgaria's General Directorate Combating Organised Crime (GDBOP), with Europol co-leading operational coordination, sharing intelligence through its SIENA network and providing technical support. Thirteen countries took part: Belgium, Bulgaria, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the United Kingdom and the United States.
Results reported for the operation:
- 29 arrests among 86 identified suspects, and 148 house searches
- 9 organised crime groups dismantled, 59 cases referred to judicial authorities and 72 investigations still open
- 27,332 URLs removed and 169 domains reported, with 722,961 infringing objects identified
- 4,370 new piracy-linked domains and 18,331 IP addresses identified for follow-up, plus 397,384 URLs reported for suspension or removal
Rights holders and anti-piracy organisations supplied information, including ACE/MPA, LaLiga, UEFA, beIN Media Group, Irdeto, Friend MTS and AAPA. The operation follows a November 2024 Europol and Eurojust action against pirate streaming services. Europol says these networks made millions from illegal access to premium sports broadcasts, films and TV channels, but it didn't publish a revenue figure.
Who is affected
- Operators and resellers of unlicensed IPTV services in the participating countries, which are the direct targets.
- Hosting providers, CDNs, domain registrars and payment providers whose services carried the streams. They are likely to receive takedown and data-preservation requests linked to the thousands of identified domains and IPs.
- Subscribers of the shut-down services, who lose access. Unofficial IPTV apps and set-top-box firmware have also long been a malware risk.
What it means for developers and engineering teams
Most developers don't run pirate IPTV services, so the direct impact is small. The operational lesson is still relevant. KRATOS 2 shows that infringement enforcement now runs as a large-scale, data-driven process: rights holders fingerprint streams, map them to URLs, domains and IP addresses, and pass the results to police through Europol. If you run a platform that hosts user content, resells compute or fronts traffic through a CDN, some of those 18,000-plus IP addresses and 397,000 reported URLs may point at infrastructure like yours.
In practice, that means being able to handle abuse reports at volume, knowing what customer data you keep and for how long, and being able to suspend a tenant quickly without affecting others. Look at the scale: 4,370 newly identified domains against 169 reported for takedown. Most of the infrastructure behind these services is disposable, and operators rotate domains and IP addresses just as phishing kits do. Rights holders' answer has been to automate detection and reporting, which means providers increasingly receive bulk, machine-generated notices. Teams that can parse those notices programmatically, match them to tenants and act on them consistently will spend far less engineering time on them than teams triaging by hand. It's also a reminder that "free" IPTV apps and sideloaded streaming APKs on company or family devices are a security problem as well as a licensing one.
What to do now
- Publish an abuse contact (the
abuse-mailboxattribute in RIR records, plus asecurity.txtorabuse@address) and make sure someone actually monitors it. - Document a tenant-suspension runbook so a valid legal or abuse notice can be handled in hours, not days.
- Review data-retention settings for access and billing logs. Know what you could be asked to preserve, and keep only what you need.
- If you run a CDN or reverse proxy for customers, rate-limit and monitor high-bandwidth live-streaming patterns on plans that aren't meant for them.
- Block sideloaded IPTV and "free streaming" apps on managed devices through MDM policy.