2026 marks the 25th anniversary of the Convention on Cybercrime (also known as the Budapest Convention).
Here are 25 selected real cases and operations against cybercrime that speak for themselves on the usefulness and relevance of the Convention and its framework in the daily work of criminal justice authorities worldwide, working on fighting against cybercrime and protecting you and your rights in cyberspace.
Albania, Germany and others: Operation “Stream”, on one of the most extensive operations in Europe to shut down darknet platform ‘Kidflix’ used for child sexual exploitation
Operation “Stream” represented Albania's participation in a major international crackdown against online child sexual exploitation and abuse, led by the Bavarian Central Office for the Prosecution of Cybercrime (ZCB) and the Bavarian State Criminal Police, and supported by Europol, with law...
Albania: Operation “End Point”, on dismantling call-center-based computer fraud networks
Operation “End Point” marked the culmination of intensive joint efforts by Albania's Cybercrime and Economic Crime Investigation Directorates to dismantle call-center based computer fraud networks operating out of Tirana. Acting on a court order issued on 15 June 2026 by the Tirana Court of First...
Albania, Germany, Cyprus and Israel: Operation “Platform”, on online investment fraud investigation
Operation “Platform” represents a significant international law enforcement action targeting organised criminal groups engaged in online investment fraud, conducted across multiple jurisdictions with the support of Europol and Eurojust. In Albania, the operation was carried out by the Cybercrime...
Albania and Austria: Operation “Ghost Call”, on large-scale online investment fraud through organised call centres in Tirana
Operation “Ghost Call” represented a joint investigation between Albanian and Austrian authorities, supported by Europol and Eurojust, targeting a criminal network involved in large-scale online investment fraud through organised call centres operating in Tirana. The two-year investigation...
Armenia and Georgia: Dismantling of an organised group planning to kidnap a US citizen woman
In the serious crimes investigation department of the investigative department of the RA investigative committee of the city of Yerevan, the preliminary investigation in the separate part of the criminal proceedings initiated on the case of the kidnapping of a US citizen woman on 4 September has...
Australia, North Macedonia: Operation “Network”, on crackdown on international child sexual abuse material distribution
Operation “Network” - Crackdown on International CSAM Distribution. Following an intelligence referral from the Australian Federal Police (AFP) liaison officer in Belgrade regarding two international criminal networks (“ADRIANA” and “NLPP”), the Cybercrime Department of North Macedonia launched...
Azerbaijan and other countries: Investigation on cyberattacks targeting the information infrastructures of various public institutions and private organisations operating in Azerbaijan
In 2009, the Republic of Azerbaijan acceded to the Council of Europe Convention on Cybercrime (Budapest Convention), significantly expanding the opportunities for international co-operation in combating cybercrime. In particular, the Convention established a legal framework for the expedited...
Belgium: The Yahoo! case – enforcing a domestic production order (Article 18.1.b Budapest Convention) against a foreign-based service provider offering services in the territory and extensive use of spontaneous information sharing (Article 26 Budapest Convention) – the "electronic evidence tennis" practice
The Yahoo! case – enforcing a domestic production order (Article 18.1.b Budapest Convention) against a foreign-based service provider offering services in the territory 2007–2015 The Yahoo! case is a landmark line of Belgian jurisprudence that illustrates how a domestic production order can...
Denmark, Bosnia and Herzegovina and others: Operation “Cumberland”, on AI-generated child sexual abuse material
Operation “Cumberland” was coordinated by Europol and involved over 20 law enforcement agencies across Europe and beyond, including the Ministry of Interior of the Republika Srpska (Bosnia and Herzegovina). The operation resulted in the arrest of 25 individuals suspected of distributing...
Germany, United States, Australia, Spain, Greece, Romania, Italy and France: Operation “Talent”, on world’s largest cybercrime forum at the time as hub for illicit activities
Operation “Talent” marked a significant international collaboration between Germany, the United States, Australia, Spain, Greece, Romania, Italy, and France, with support from Europol. The operation targeted "nulled.to" and "cracked.io", the world's largest cybercrime forums at that time, which...
Germany, Serbia, Bulgaria, Cyprus: Operation “Operator”, on fraudulent cryptocurrency investment schemes through call centres operating in three countries
Operation “Operator” was launched following intelligence shared by German law enforcement (BKA) through the 24/7 network under the Convention on Cybercrime (Budapest Convention). This triggered a Joint Investigation Team (JIT) coordinated by Germany, Europol, and Eurojust, involving Serbia,...
Germany, Albania, Bosnia and Herzegovina and Kosovo*: Operation “Pandora”, on large-scale investigation targeting a criminal network operating fraudulent call centers across the Western Balkans and the Middle East
Operation “Pandora” represented a large-scale international investigation led by German authorities, supported by Europol and Albania, Bosnia and Herzegovina and Kosovo*, targeting a criminal network operating fraudulent call centers across the Western Balkans and Middle East. The operation...
North Macedonia: "Frank Castle" case, on dissemination of a racist and xenophobic video material via social media in the context of the COVID-19 pandemic
The Basic Public Prosecutor's Office in Skopje, upon receiving a report, opened a case concerning the publication of a video on the social media platform Twitter entitled "Only Nuclear Power for Us", posted by a profile using the username @skopskipunisher ("Frank Castle"). On 30 January 2020, the...
North Macedonia, Serbia, Bulgaria: International credit card theft group busted in North Macedonia
The Macedonian police arrested five Macedonian and two Serbian members of an international credit card theft group, the police said. A Bulgarian national is also believed to be a member of the group which stole over MKD 4 million (USD 92,000) from Macedonian citizens between November 2011 and...
North Macedonia: “Public room” case, on enabling the dissemination of unlawful audiovisual material depicting explicit sexual acts involving a child
Criminal proceedings were conducted against two defendants for the criminal offence of Production and Distribution of Child Pornography under Article 193-a, paragraph 3 in conjunction with paragraph 1 of the Criminal Code. Both of them were indicted. According to the indictment, during the period...
North Macedonia: Disruption of illegal online marketplace
Takedown of the “OLVX” Illegal Online Marketplace. The Cybercrime Department of North Macedonia, in coordination with international partners, including the Federal Bureau of Investigation (FBI), has disrupted an illegal online marketplace known as “OLVX”. Active since July 2023 across multiple...
Panama: Practical example of cross-border co-operation in emergency situations with service providers regarding an alleged firearms attack planned online
The Public Prosecutor’s Office received information regarding the alleged commission of a criminal act. Based on the data obtained, a website was identified where several individuals were planning attacks with firearms at schools; one of the participants posted that he would attack an elementary...
Republic of Moldova, the Netherlands: Identification and arrest of a foreign national in the Republic of Moldova internationally wanted for serious ransomware and other cybercrime offences committed abroad
In 2025, the Republic of Moldova successfully participated in a joint international cybercrime operation with the law enforcement authorities of the Kingdom of the Netherlands, demonstrating the practical value of Article 35 (24/7 Network) of the Convention on Cybercrime (Budapest Convention) The...
Romania and Italy: “Operation Bruno”, on banking fraud scheme using spear phishing e-mails impersonating tax authorities to steal online banking credentials
Operation “Bruno” represented the first time Romania and Italy established a Joint Investigation Team (JIT) and employed cross border data preservation to secure critical digital evidence throughout a case. This two-year investigation by Romanian and Italian Police, supported by Europol and...
Serbia: Forgery misuse of payment cards
In December 2025, the Serbian Police, Cybercrime Unit, in coordination with the Higher Public Prosecutor’s Office in Belgrade, Special Department for Cybercrime arrested two Chinese nationals for committing criminal offences forgery misuse of payment cards and unlawfully obstructed and restricted...
Ukraine, Germany, Norway, Poland, Latvia, United States, Finland, Portugal, Lithuania, United Kingdom, France: International operations conducted by the Cyber Police Department on cyber-enabled and cyber-dependent crimes
Since the beginning of 2026, the Cyber Police Department of the National Police of Ukraine has conducted 12 international cyber operations in co-operation with law enforcement authorities from Europe and North America. These operations targeted a broad spectrum of cyber-enabled and...
United States, Austria, Bulgaria, France, Germany, Hungary, the Netherlands, Romania: Authorities dismantle global malicious proxy service that deployed malware and defrauded thousands of U.S. persons, businesses, and financial institutions of millions of dollars in losses
A court-authorized international law enforcement operation led by the U.S. Justice Department disrupted SocksEscort, a residential proxy network used to exploit thousands of residential routers worldwide and commit large-scale fraud. The U.S. government executed seizure warrants against a few...
United States, Australia, Belgium, Canada, Germany, Greece, Kosovo*, Malaysia, Netherlands, Poland, Portugal, Romania, Spain, the United Kingdom: Dismantlement of one of the world’s largest hacker forums used for buying and selling stolen data and cybercrime tools
The Department of Justice announced the seizure of the LeakBase database, one of the world’s largest online forums for cybercriminals to buy and sell stolen data and cybercrime tools. According to an affidavit unsealed on 3 March, the LeakBase forum had over 142,000 members and more than 215,000...
United States, Bulgaria, Romania: Law enforcement assists Bulgarian law enforcement in taking down three of the largest piracy sites in the European Union
The three websites were allegedly operated from Bulgaria and offered thousands of copyrighted movies, television shows, and other content without authorization. The U.S. government executed seizure warrants against three U.S.-registered internet domains of commercial websites allegedly engaged in...
United States, Italy and France: Domain names publishing nude digital forgeries of famous women seized
Use of new TAKE IT DOWN Act to halt non-consensual publication of intimate visual depictions The U.S. Departments of Justice and Homeland Security seized the domains CFAKE.com and SOCFAKE.com, which are domains that were being used to publish thousands of digitally forged images and videos...