Operation Saffron was a 27-country operation
Assessment
The figure of 27 countries is widely repeated in coverage of Operation Saffron, but it describes where the 33 seized First VPN servers were physically hosted, not the number of countries that ran the operation. Eurojust's release frames the operation differently: a 7-country investigating group (France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine and the United Kingdom) with a 16-country Europol operational taskforce. So 'a 27-country operation' conflates the geographic spread of the criminal infrastructure with the international coalition that took it down. The takedown was genuinely multinational, but the specific '27 countries' number counts server locations, and repeating it as the size of the law-enforcement coalition overstates and mislabels it.
Where this claim appeared
Tom's Hardware · 2026-05-21
https://www.tomshardware.com/tech-industry/cyber-security/europols-operation-saffron-takes-down-first-vpn-service-over-ransomware-attacks-33-servers-and-multiple-domains-seizedWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Operation Saffron: Europol dismantles First VPN, the bulletproof anonymity layer behind years of ransomware casesThink this assessment is wrong? Report an error.