INTERPOL-led operation arrests 1,462 suspects, disrupts 10,909 cybercrime networks

Past-week coverage · Original source published 2026-10-22.

INTERPOL said a coordinated law enforcement action across 21 countries led to the arrest of 1,462 suspects and the disruption of 10,909 malicious networks, according to an announcement the agency made on Thursday.

The operation, codenamed Operation Serengeti III, ran between June 29 and August 31, 2026. INTERPOL also said authorities recovered more than $105 million in illicit funds.

The agency's statement, as reported, says authorities "identified" targets during the operation, but the retained account does not detail which crime types were involved, how the networks were disrupted, or how the recovered funds were traced. Those specifics would matter for defenders trying to judge whether the takedowns touch infrastructure they rely on.

Why it matters

Large multi-country sweeps show how much cybercrime enforcement now depends on coordination between agencies in different jurisdictions. They also tend to be announced in aggregate, which makes it hard for outside organizations to map the results to their own threat exposure.

What defenders can do

• Treat headline arrest and takedown figures as context, not as an all-clear. Criminal infrastructure often gets rebuilt or replaced.
• Watch for follow-up advisories from national agencies and from INTERPOL that name specific malware families, services or payment channels.
• Keep fraud and account-takeover controls in place regardless of enforcement news, since the retained source gives no detail on which schemes were targeted.

The source does not say whether further arrests or charges are expected.